How to implement Server Name Indication(SNI) on OpenSSL in C or C++?
Are there any real world examples available?
On the client side, you use SSL_set_tlsext_host_name(ssl, servername)
before initiating the SSL connection.
On the server side, it's a little more complicated:
SSL_CTX()
for each different certificate;SSL_CTX()
using SSL_CTX_set_tlsext_servername_callback()
;SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name)
. Figure out the right SSL_CTX
to go with that host name, then switch the SSL
object to that SSL_CTX
with SSL_set_SSL_CTX()
.The s_client.c
and s_server.c
files in the apps/
directory of the OpenSSL source distribution implement this functionality, so they're a good resource to see how it should be done.
SSL_CTX()
per certificate, per thread (and always handle the same SSL
and SSL_CTX
objects from the same thread). The other way is to set thread callbacks with CRYPTO_set_id_callback()
and CRYPTO_set_locking_callback()
, in which case OpenSSL will make the right calls to the locking callback to make SSL_set_SSL_CTX()
thread-safe.
SSL_set_SSL_CTX
innately not thread safe? It seems to only affect the SSL connection specified in the first argument.
s_client
to test your server.