Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Assume there are two servers; has a standard SSL certificate installed and has a wildcard SSL certificate (* installed.

Next, assume you make from server 1 via SSL connection an API call to

If someone eavesdrops on the connection, which URL of server2 would the sniffer see?

Would the sniffer see or the subdomain that was called

share|improve this question
Besides of SSL handshakes the eavesdropper could also see some DNS requests, which might reveal the actual called URL. – Manuel Faux Nov 3 '13 at 15:12
up vote 2 down vote accepted

The Server Name Indication extension, now implemented by most SSL libraries, implies that a sniffer would see the name as part of the unencrypted ClientHello message from server1.

As for the rest of the URL (the path on server2), it is sent only after the handshake, so it is not visible to sniffers (but sniffers may still obtain a good estimate of the path length, in characters).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.