I am running here a multi-tenant web site with vhosts in Apache 2.4.10 in Jessie.

I am trying to disable the possibility of non-SNI clients to access (the default) SSL site.

For that I setup in /etc/apache2/mods-available/ssl.conf

SSLStrictSNIVHostCheck On

From the file:

SSLStrictSNIVHostCheck : Whether to forbid non-SNI clients to access name based virtual hosts.

However, after restarting apache, non-SNI clients are still able to access the default SSL host.

For instance, this still works:

openssl s_client -connect localhost:443 

Likewise, trying to access a vhost without SNI, using

openssl s_client -connect domain.com:443 

still returns the default SSL domain, whist accessing the same host with SNI:

openssl s_client -connect domain.com:443 -servername domain.com

returns the appropriate page from the vhost.

I also tried putting the SSLStrictSNIVHostCheck On directive in the default SSL vhost to no avail.

Am I missing something obvious?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.