{"id":3697,"date":"2017-11-17T01:24:58","date_gmt":"2017-11-17T09:24:58","guid":{"rendered":"https:\/\/cheapsslsecurity.com\/blog\/?p=3697"},"modified":"2021-01-26T07:31:23","modified_gmt":"2021-01-26T15:31:23","slug":"simplified-what-is-sni-server-name-indication-how-does-it-work","status":"publish","type":"post","link":"https:\/\/cheapsslsecurity.com\/blog\/simplified-what-is-sni-server-name-indication-how-does-it-work\/","title":{"rendered":"Simplified: What Is SNI (Server Name Indication)? How Does It Work?"},"content":{"rendered":"

Untangling the technology that is Server Name Indication (SNI)<\/h2>\n

Want to know what is SNI and how it works? Well, you\u2019re at the right place (not sure about the right time though). Quite often, this great technology goes under the radar, and that’s somewhat understandable. So here we are, doing what we always do \u2013 unscrambling the \u201ctechnical\u201d stuff.<\/p>\n

Let\u2019s get under the hood of the technology that is Server Name Indication.<\/p>\n

HTTPS and IP Addresses: A Match NOT Made in Heaven<\/h3>\n

Let\u2019s say you have five HTTP websites and you want to run them on a single IP address. What do you do? You use Name-based hosts, that\u2019s what. So, when a user requests a particular site out of five, it uses a unique HTTP header that includes hostname. In response, your server matches this header and paves the way to the requested website.<\/p>\n

\"http<\/p>\n

However, this won’t work in the case of HTTPS. That’s because the HTTPS protocol uses an SSL\/TLS handshake to enforce secure communications<\/a> between the client (browser) and server. The HTTP header will only be sent once the handshake is over. As the server cannot see the information present in the HTTP header, it cannot possibly know which website to respond with.<\/p>\n

How SNI Saved the Day (and money!)<\/h3>\n

Before SNI was introduced, one had to purchase a unique IP address for every SSL certificate he\/she had. This resulted in huge costs and expeditious consumption of IPv4 IP addresses. If not stopped, it would have led to rapid exhaustion of IPv4 IP addresses as there could only be around 4 billion IPv4 addresses. This depletion was inevitable, but the purpose was to delay it as much as possible to give the users enough time to migrate to IPv6, which can have around 340 undecillion (Yes, that\u2019s a number!) unique IP addresses.<\/p>\n

That\u2019s why SNI had to be introduced.<\/p>\n

\"SNI<\/p>\n

Server Name Indication (SNI), an extension to the SSL\/TLS protocol allows multiple SSL certificates to be hosted on a single unique IP address. SNI does this by inserting the HTTP header (virtual domain) in the SSL\/TLS handshake. As the server is able to see the virtual domain, it serves the client with the website he\/she requested.<\/p>\n

A win-win for everyone!<\/p>\n

Is SNI Scalable?<\/h3>\n

The biggest and perhaps the only concern with SNI was its scalability. Initially, there weren\u2019t many web browsers and servers supporting SNI technology. Today, that scenario has turned upside down. Almost 98% of the clients requesting an HTTPS-enabled site support SNI<\/a>.<\/p>\n

So, you don\u2019t need to worry about losing your audience.<\/p>\n

What did we learn?<\/h3>\n