I am running here a multi-tenant web site with vhosts in Apache 2.4.10 in Jessie.
I am trying to disable the possibility of non-SNI clients to access (the default) SSL site.
For that I setup in
From the file:
SSLStrictSNIVHostCheck : Whether to forbid non-SNI clients to access name based virtual hosts.
However, after restarting
apache, non-SNI clients are still able to access the default SSL host.
For instance, this still works:
openssl s_client -connect localhost:443
Likewise, trying to access a vhost without SNI, using
openssl s_client -connect domain.com:443
still returns the default SSL domain, whist accessing the same host with SNI:
openssl s_client -connect domain.com:443 -servername domain.com
returns the appropriate page from the vhost.
I also tried putting the
SSLStrictSNIVHostCheck On directive in the default SSL vhost to no avail.
Am I missing something obvious?