Is it possible to use SNI (server name indication) in SSLv3 or SSLv2 handshake? From the search queries, it seems SNI is TLS extension. Is there any alternate to SNI?


The SSL-3.0 specification contains the following excerpt, in the description of the ClientHello message:

  Forward compatibility note: In the interests of forward
  compatibility, it is permitted for a client hello message to include
  extra data after the compression methods.  This data must be included
  in the handshake hashes, but must otherwise be ignored.

What this means is that while TLS extensions were only defined, formally, for TLS-1.0 and later, they can be included in a ClientHello for SSL-3.0, and nothing prevents any client or server to actually use such extensions as part of a SSL-3.0 handshake. OpenSSL, however, appears unwilling to do just so. Notably, the command-line tool, when used as a client (openssl s_client), does not send a SNI extension (or any extension) when instructed to use SSL-3.0 only.

There is no room for extensions in a SSL-2.0 ClientHello message. A consequence is that if a client wishes to support a SSL-2.0-only server, then it must send its ClientHello in the SSL-2.0 format, and this prevents the use of any extension.

Note that SNI support involves both client and server (the client must send the extension, the server must understand it). Old clients may not know about SNI (a notable example being Internet Explorer when running on Windows XP). A client that requires using SSL-2.0 or SSL-3.0, but does not support TLS-1.0, must be quite old (more than 15 years) and is unlikely to be aware of the existence of SNI. TLS-1.0 was published in January 1999 while SNI was first formally published in June 2003.

In any case, you should not use either SSL-2.0 or SSL-3.0, both of which having irremediable security issues. There is even a standard that prohibits using SSL-2.0. It can be argued that a Web browser that does not know SNI or TLS-1.0 is a browser that has not been updated for many years, and therefore must include a huge number of known vulnerabilities, and is probably already host to a handful of malware and part of one or several botnets. In that view, the only sane behaviour of a Web server that receives a connection request limited to SSL-3.0 (or lower) is to reject it unconditionally. It may be contagious.

  • Will the clients include SNI if the initial request is discarded? (As on apache SSLStrictSNIVHostCheck on) – NPC Sep 29 '15 at 14:19
  • 1
    Usually, clients that know about extensions like SNI first try connecting with the extension, and fallback to not sending the extension only as a second try; not the other way round. If you have a SSL-3.0-only client that does not send a SNI, then chances are that the client will never send a SNI (and it should have been upgraded more than a decade ago). – Tom Leek Sep 29 '15 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.