Search code examples
phpsslsni

Can SNI be enabled without problems to servers that do not support SNI in TLS handshake


We want to enable SNI (Server Name Indication) in a PHP client that connects to various external endpoints (SOAP/REST). Some of these endpoints support SNI as a server, but some don't. Can enabling SNI on all outgoing request cause problems on servers that do not support SNI?


Solution

  • SNI is an optional TLS extension ("server_name"). This means any proper TLS stack which does not explicitly support this extension will ignore it. SNI is widely used and all modern browsers have enabled it.

    This gives some confidence that almost all sites should work if you use TLS with SNI enabled. There might be still some sites out there which use a broken TLS stack which will fail just because SNI is present. But these sites will fail too when accessed by a modern browser. Also, way more sites will fail if SNI is not present, like everything behind Cloudflare Free SSL. Thus enabling SNI by default and maybe dealing with the fallout of a very few broken sites is definitely better then dealing with lots of sites which don't work without SNI.