Skip to main content

SSL sites on shared IP via SNI

SSL Sites On Shared IP via SNI




Days are gone when we needed a dedicated IP for each website with SSL!
With Server Name Indication(SNI) extension of the Transport Layer Security protocol, it is now possible to use authentic SSL certificates for sites hosted on shared IP addresses. If you are on a Linux hosted environment, you could very well reap the benefit of the feature right away.

Key benefits

1. Reduces the cost of adding dedicated IP addresses
2. All domains can have their own SSL certificates installed

How it works!

We all know how SSL works. In normal SSL, when a user types “https” in a browser’s URL field, the encryption is provided by the Transport Layer Security (TLS) protocol. TLS uses a digitally signed certificate that includes the domain name of the site to ensure that the user connects to the correct site requested. Browsers like Internet Explorer, Mozilla, Opera, Google chrome generally accepts the certificate as “trusted” if it is signed by a trusted certification authority.
In the TLS start-up phase, the browser compares the user-entered domain part of the URI with the domain name found in the server’s certificate (CN or subjectAltName). If this comparison fails, a warning is received by the customer.
In TLS encryption, the server must select and send the certificate based on the destination IP address, before it reads the domain name in the HTTP request. Thus when in a virtual hosting environment, it presents the wrong certificate(usually default for the server) and causes the browser to warn the user of a mismatch in name.
An extension to TLS called Server Name Indication(SNI), addresses this issue by sending the name of the virtual domain as part of the TLS negotiation. This enables the server to “switch” to the correct virtual domain early and present the browser with the certificate containing the correct CN (Common Name).

Is it supported by all browsers?

Most browsers, including Internet Explorer 7 or later, Mozilla Firefox, Safari 2.1 or later, Opera 8.0 or later, Google Chrome etc. supports TLS SNI. The complete list can be viewed at
 http://en.wikipedia.org/wiki/Server_Name_Indication
Thus the success of choosing SNI, largely depends on the browsers used by your customer base.

How to implement this feature in my Hosting?

SNI support is included in Parallels Plesk Panel for Linux (versions 10.2 or higher) and allows using different SSL certificates for sites hosted on the same shared IP address. Cpanel is yet to implement this feature and developers are already working on it.

Which Operating system should I choose for this to work?

As per Parallels, this feature is available on the following operating systems:
OpenSuSE Linux 11.3 or later.
Ubuntu Linux 10.4 or later.
Debian Linux 6.0 or later.
RedHat Linux 6.0 or later.
CentOS 5.0 or later (only with Apache and OpenSSL supplied with Panel).
In the near future this will be an effective solution to save the cost on dedicated IP addresses and their availability.
**********************************************************************

FEED



Share











SUPPORT











VISIT COUNTER !!





******************************************************* 
Labels:

Comments

Post a Comment

Popular posts from this blog

Hacking via Cloning Site Using Kali Linux

Hacking via Cloning Site Using Kali Linux Hacking via Cloning Site Using Kali Linux  SET Attack Method : SET stands for Social Engineering Toolkist , primarily written by  David Kennedy . The Social-Engineer Toolkit (SET) is specifically designed to perform advanced attacks against the human element. SET was designed to be released with the  http://www.social-engineer.org  launch and has quickly became a standard tool in a penetration testers arsenal. The attacks built into the toolkit are designed to be targeted and focused attacks against a person or organization used during a penetration test. Actually this hacking method will works perfectly with DNS spoofing or Man in the Middle Attack method. Here in this tutorial I’m only writing how-to and step-by-step to perform the basic attack , but for the rest you can modified it with your own imagination. In this tutorial we will see how this attack methods can owned your com...
Post a Comment
Read more

Defacing Sites via HTML Injections (XSS)

Defacing Sites via HTML Injections Defacing Sites via HTML Injections What Is HTML Injection: "HTML Injection" is called as the Virtual Defacement Technique and also known as the "XSS" Cross Site Scripting. It is a very common vulnerability found when searched for most of the domains. This kind of a Vulnerability allows an "Attacker" to Inject some code into the applications affected in order to bypass access to the "Website" or to Infect any particular Page in that "Website". HTML injections = Cross Site Scripting, It is a Security Vulnerability in most of the sites, that allows an Attacker to Inject HTML Code into the Web Pages that are viewed by other users. XSS Attacks are essentially code injection attacks into the various interpreters in the browser. These attacks can be carried out using HTML, JavaScript, VBScript, ActiveX, Flash and other clinet side Languages. Well crafted Malicious Code can even hep the ...
Post a Comment
Read more

Hacking DNN Based Web Sites

Hacking DNN Based Web Sites Hacking DNN Based Web Sites Hacking DNN (Dot Net Nuke) CMS based websites is based on the Security Loop Hole in the CMS. For using that exploit we will see the few mentioned points which illustrates us on how to hack any live site based on Dot Net Nuke CMS. Vulnerability : This is the know Vulnerability in Dot Net Nuke (DNN) CMS. This allows aone user to Upload a File/Shell Remotely to hack that Site which is running on Dot Net Nuke CMS. The Link's for more Information regarding this Vulnerability is mentioned below -                                  http://www.exploit-db.com/exploits/12700/ Getting Started : Here we will use the Google Dork to trace the sites that are using DNN (Dot Net Nuke) CMS and are vulnerable to Remote File Upload. How To Do It : Here, I an mentioning the few points on how to Search for the existing Vulnerability in DNN. Let'...
Post a Comment
Read more

Excellent tricks and techniques of Google Hacks

Frontpage.. very nice clean search results listing !! I magine with me that you can steal or know the password of any web site designed by "Frontpage". But the file containing the password might be encrypted; to decrypt the file download the program " john the ripper". To see results; just write in the ( http://www.google.com/ ) search engine the code: "# -FrontPage-" inurl:service.pwd ============================================== This searches the password for "Website Access Analyzer", a Japanese software that creates webstatistics. To see results; just write in the ( http://www.google.com/ ) search engine the code: "AutoCreate=TRUE password=*" ============================================== This is a query to get inline passwords from search engines (not just Google), you must type in the query followed with the the domain name without the .com or .net. To see results; just write in the ( http://www.google.co...
Post a Comment
Read more

Hacking via BackTrack using SET Attack Method

Hacking via BackTrack using SET Attack Method Hacking via BackTrack using SET Attack  1. Click on Applications, BackTrack, Exploit Tools, Social Engineering Tools, Social Engineering Toolkit then select set.
Post a Comment
Read more