Skip to content

Instantly share code, notes, and snippets.

@alex
Created March 15, 2015 21:42
Show Gist options
  • Save alex/3367e0de1b9187152c3d to your computer and use it in GitHub Desktop.
Save alex/3367e0de1b9187152c3d to your computer and use it in GitHub Desktop.
diff --git a/pages/sni.md b/pages/sni.md
index acd285c..ce6a71c 100644
--- a/pages/sni.md
+++ b/pages/sni.md
@@ -4,10 +4,10 @@ title: Server Name Indication
permalink: /sni/
---
-**Server Name Indication**, often abbreviated SNI, is a TLS extension with which the client can indicate to the server to which hostname it is attempting to connect. If the [server handles traffic for multiple hostnames](https://en.wikipedia.org/wiki/Virtual_hosting#Name-based), then without the client's explicit indication of which hostname it is attempting to connect to, the server may have difficulty determining the appropriate server certificate to present to the client in the TLS handshake.
+**Server Name Indication**, often abbreviated SNI, is a TLS extension with which the client can indicate to the server which hostname it is trying to connect to. This allows the [server to handles traffic for multiple hostnames](https://en.wikipedia.org/wiki/Virtual_hosting#Name-based). Without SNI, the server would not know which certificate to present to the client in the TLS handshake. In practice this means that to support clients without SNI, each hostname/certificate pair requires its own IP address.
-Some web servers may not require SNI in order to determine the correct certificate to serve. For example, the server may only ever handle traffic for a single hostname. Alternatively, the server may be able to determine the hostname the client wants to connect to if, for a given server IP address, there is only a single hostname that resolves to that address. Additionally, a single certificate may be able to cover all the possible hostnames for a given server IP address using [wildcards](https://en.wikipedia.org/wiki/Wildcard_certificate) or [Subject Alternative Names](https://en.wikipedia.org/wiki/SubjectAltName).
+If a server only ever handles traffic for a single hostname, there's no need for SNI. Similarly, a server may have multiple IP address, each of which is used only for a single hostname/certificate pair. Additionally, a single certificate may be able to cover all the possible hostnames for a given server IP address using [wildcards](https://en.wikipedia.org/wiki/Wildcard_certificate) or [Subject Alternative Names](https://en.wikipedia.org/wiki/SubjectAltName).
-However, in many cases, such as [content distribution networks (CDNs)](https://en.wikipedia.org/wiki/Content_delivery_network), the server services far too many disparate hostnames to reasonably share a single server certificate. Due to the scarcity of IPv4 addresses, it is also long-term untenable to simply acquire a new IPv4 address for each hostname. In such situations, client SNI support is extremely useful.
+However, in many cases, such as [content distribution networks (CDNs)](https://en.wikipedia.org/wiki/Content_delivery_network), the server services far too many unrelated hostnames to reasonably share a single server certificate. Due to the scarcity of IPv4 addresses, it is also long-term untenable to simply acquire a new IPv4 address for each hostname. Therefore, client SNI support is extremely useful.
Thus, it can be highly desirable for servers to depend on client SNI support. All modern browsers support SNI, but some older browsers on older OSes (notably IE6 and Android versions before Honeycomb). Depending on what clients are necessary to support, servers may or may not be able to depend on client SNI support. For more details on what clients support SNI, please refer to http://en.wikipedia.org/wiki/Server_Name_Indication#Client_side.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment