Server Name Indication

Unlimited redistribution and modification of this document is allowed provided that the above copyright notice and this permission notice remains intact.

This specification is a work-in-progress and may have major incompatible changes without warning.

This specification may change at any time and we do not recommend implementing it in a production environment.

Description

Server Name Indication (SNI) is a mechanism in the TLS protocol in which a TLS client indicates at the beginning of the handshake which hostname it is connecting to.

Uses

Servers can use this information to choose which certificate to send to the client. This is needed because servers may have more than one certificate, for example a server may have two certificates: one for irc.example.net and another one for server.example.net. In this scenario, when a client connects the server has no way of knowing which certificate to offer because it does not know at the time of the handshake which hostname the client is using.

SNI fixes this problem by sending the hostname to the server early, so the server can choose the certificate corresponding to the hostname the client is using.

Requirements

Clients MUST use SNI when connecting to servers via TLS. (This implies that a TLS version capable of SNI, i.e. at least TLS 1.1, is required.)