What does this notice mean "SNI: extension not received from the client", in stunnel log?

What does this notice mean "SNI: extension not received from the client", in stunnel log

  • I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of stunnel to provide multiple domain certificates. Using javascript websocket i am trying to connect to secure server, But log file output shows SNI: extension not received from the client So i am not sure about sni option supports or not. Could any one help me to explain its working or not. What is the meaning of "SNI: extension not received from the client" statement. Thanks in advance for your valuable answers. My stunnel.config file output=/var/log/stunnel.log pid= debug = 7 fips = no compression = rle options = NO_SSLv2 syslog = no [websockets] cert = /usr/local/etc/stunnel/default.crt key = /usr/local/etc/stunnel/default.key accept = 0.0.0.0:9443 connect = 127.0.0.1:9000 [sni1] sni = websockets:mailxf.test.int cert = /usr/local/etc/stunnel/test.int.crt key = /usr/local/etc/stunnel/test.int.key connect = 127.0.0.1:9000 [sni2] sni = websockets:mailxf.test1.int cert = /usr/local/etc/stunnel/test1.int.crt key = /usr/local/etc/stunnel/test1.int.key connect = 127.0.0.1:9000 Log file output Service [websockets] accepted (FD=9) from 192.168.0.132:38257 2014.04.14 18:30:32 LOG7[7085:139648669734672]: Service [websockets] started 2014.04.14 18:30:32 LOG5[7085:139648669734672]: Service [websockets] accepted connection from 192.168.0.132:38257 2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): before/accept initialization **2014.04.14 18:30:32 LOG5[7085:139648669734672]: SNI: extension not received from the client** 2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 read client hello A 2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 write server hello A 2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 write change cipher spec A 2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 write finished A 2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 flush data 2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 read finished A 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 2 items in the session cache 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 0 client connects (SSL_connect()) 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 0 client connects that finished 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 0 client renegotiations requested 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 19 server connects (SSL_accept()) 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 19 server connects that finished 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 0 server renegotiations requested 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 14 session cache hits 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 0 external session cache hits 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 0 session cache misses 2014.04.14 18:30:32 LOG7[7085:139648669734672]: 2 session cache timeouts 2014.04.14 18:30:32 LOG6[7085:139648669734672]: SSL accepted: previous session reused 2014.04.14 18:30:32 LOG6[7085:139648669734672]: connect_blocking: connecting 127.0.0.1:9000 2014.04.14 18:30:32 LOG7[7085:139648669734672]: connect_blocking: s_poll_wait 127.0.0.1:9000: waiting 10 seconds 2014.04.14 18:30:32 LOG5[7085:139648669734672]: connect_blocking: connected 127.0.0.1:9000 2014.04.14 18:30:32 LOG5[7085:139648669734672]: Service [websockets] connected remote server from 127.0.0.1:44325 2014.04.14 18:30:32 LOG7[7085:139648669734672]: Remote socket (FD=10) initialized Javascript code to connect secure server, wss://mailxf.test.int:9443/bo/socket.bo.php I am using webbrowser version as Chrome 26 and firefox 24 and OS version centos 6.

  • Answer:

    You tried to connect directly to an IP address, rather than a hostname. So there wouldn't be any point to SNI, as you didn't provide a name. You're meant to use the hostname. For instance: wss://example.com:9443/bo/socket.bo.php

Kaustubh Khare at Server Fault Visit the source

Was this solution helpful to you?

Just Added Q & A:

Find solution

For every problem there is a solution! Proved by Solucija.

  • Got an issue and looking for advice?

  • Ask Solucija to search every corner of the Web for help.

  • Get workable solutions and helpful tips in a moment.

Just ask Solucija about an issue you face and immediately get a list of ready solutions, answers and tips from other Internet users. We always provide the most suitable and complete answer to your question at the top, along with a few good alternatives below.