Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Assume there are two servers; server1.com has a standard SSL certificate installed and server2.com has a wildcard SSL certificate (*.server2.com) installed.

Next, assume you make from server 1 via SSL connection an API call to api2.server2.com...

If someone eavesdrops on the connection, which URL of server2 would the sniffer see?

Would the sniffer see server2.com or the subdomain that was called api2.server2.com?

share|improve this question
    
Besides of SSL handshakes the eavesdropper could also see some DNS requests, which might reveal the actual called URL. –  Manuel Faux Nov 3 '13 at 15:12

1 Answer 1

up vote 2 down vote accepted

The Server Name Indication extension, now implemented by most SSL libraries, implies that a sniffer would see the name api2.server2.com as part of the unencrypted ClientHello message from server1.

As for the rest of the URL (the path on server2), it is sent only after the handshake, so it is not visible to sniffers (but sniffers may still obtain a good estimate of the path length, in characters).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.