Hacker News new | ask | show | jobs
by LordIllidan 4287 days ago
Just a normal SSL error, or would they be able to see another site?

I had an issue like this with SNI where a client reported being able to see another site that was on the same IP. The issue was that she was using IE on Windows XP, and SNI didn't work.
1 comments
mike-cardwell 4287 days ago
A web server can be configured to send a default ssl cert if the browser does not support SNI, but can still route the request to the correct virtual host based on the HTTP Host: header if the customer clicks through the warning.

The following two https sites exist on the same IP:

grepular.com emailprivacytester.com

If your browser doesn't support SNI, then the cert for "grepular.com" will be returned by default. So browsers which don't support SNI will not notice anything unusual when visiting https://grepular.com/, but will get the cert for grepular.com instead of emailprivacytester.com when visiting https://emailprivacytester.com/

Unless you have IPv6 support, in which case the sites have different IPs so SNI isn't required (exactly like cloudflare have just done)

link