<html><head>
<meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type">
</head><body bgcolor="#FFFFFF" text="#000000">Hi Maxim,<br>
<br>
Thank you a lot for the quick reply, I'll give it a test tomorrow
morning!<br>
<br>
And Robert has a valid point indeed, why is it actually disabled by
default?<br>
<span>
</span><br>
<blockquote style="border: 0px none;"
cite="mid:34F1666C-9867-4E77-8AF7-C09E00428860@fearnothingproductions.net"
type="cite">
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="width:100%;border-top:1px solid #EDEEF0;padding-top:5px"> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:49%;">
<a moz-do-not-send="true"
href="mailto:rpaprocki@fearnothingproductions.net" style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Robert Paprocki</a></div> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:48%;text-align:
right;"> <font color="#9FA2A5"><span style="padding-left:6px">14
February 2016 at 22:46</span></font></div> </div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div><br></div><div><!----><br>Out
of curiosity, is there a philosophical/design reason this option is not
enabled by default?<br><br>_______________________________________________<br>nginx
mailing list<br><a class="moz-txt-link-abbreviated" href="mailto:nginx@nginx.org">nginx@nginx.org</a><br><a class="moz-txt-link-freetext" href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/mailman/listinfo/nginx</a><br></div></div>
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="width:100%;border-top:1px solid #EDEEF0;padding-top:5px"> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:49%;">
<a moz-do-not-send="true" href="mailto:mdounin@mdounin.ru"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Maxim Dounin</a></div> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:48%;text-align:
right;"> <font color="#9FA2A5"><span style="padding-left:6px">14
February 2016 at 21:58</span></font></div> </div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody"><div>Hello!<br><br></div><div><!----><br><a class="moz-txt-link-freetext" href="http://nginx.org/r/proxy_ssl_server_name">http://nginx.org/r/proxy_ssl_server_name</a><br><br></div></div>
<div style="margin:30px 25px 10px 25px;" class="__pbConvHr"><div
style="width:100%;border-top:1px solid #EDEEF0;padding-top:5px"> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:49%;">
<a moz-do-not-send="true" href="mailto:lucas@slcoding.com"
style="color:#737F92
!important;padding-right:6px;font-weight:bold;text-decoration:none
!important;">Lucas Rolff</a></div> <div
style="display:inline-block;white-space:nowrap;vertical-align:middle;width:48%;text-align:
right;"> <font color="#9FA2A5"><span style="padding-left:6px">14
February 2016 at 20:14</span></font></div> </div></div>
<div style="color:#888888;margin-left:24px;margin-right:24px;"
__pbrmquotes="true" class="__pbConvBody">Hi guys,
<br>
<br>I'm having a rather odd behavior - I use nginx as a reverse proxy
(basically as a CDN) - where if the file isn't in cache, I do use
proxy_pass to the origin server, to get the file and then cache it.
<br>
<br>This works perfectly in most cases, but if the origin is running
apache
and happen to use the Apache Directive "SSLStrictSNIVHostCheck" where
it's set to On.
<br>
<br>Basically it decides whether a non-SNI client is allowed to access a
name-based virtual host over SSL or not.
<br>But when using proxy_pass this seems to the apache server that it's a
non-SNI client:
<br>[Sun Feb 14 19:32:50 2016] [error] No hostname was provided via SNI
for
a name based virtual host
<br>[Sun Feb 14 19:33:00 2016] [error] No hostname was provided via SNI
for
a name based virtual host
<br>
<br>I was able to replicate this issue on multiple nginx versions (both
on
1.8.1, 1.9.9 and 1.9.10).
<br>It results in 403 forbidden for the client.
<br>
<br>If I set the directive SSLStrictSNIVHostCheck to off, I do not get a
403
forbidden - and the files I try to fetch gets fetched correctly.
(Meaning proxy_pass do understand SNI).
<br>
<br>The nginx zone does a proxy_pass <a class="moz-txt-link-freetext" href="https://my_domain">https://my_domain</a>; and the
my_domain is
running on a server that runs SNI.
<br>
<br>Best Regards,
<br>Lucas Rolff
<br></div>
</blockquote>
<br>
</body></html>