Imagine you’re the ruler of a digital fortress. Your website attracts visitors from all over the world, and you have several majestic towers – one for each service you offer. But there’s a problem: without a special security mechanism, attackers could easily target the weakest tower.
This is where Server Name Indication (SNI) comes in — an unassuming yet powerful feature that helps secure your digital stronghold.
What Is SNI?
SNI is an extension of the TLS protocol (Transport Layer Security) that allows multiple SSL/TLS certificates to be used on a single IP address.
It sends the server name (i.e., the domain) during the initial connection handshake, enabling the web server to provide the correct certificate for the encrypted session.
In other words: multiple domains can share one IP address — without compromising security.
Where Is SNI Used?
SNI is essential in the world of web hosting. Many companies use shared hosting, where several websites run on a single server. Thanks to SNI, each of these sites can have its own SSL/TLS certificate, without needing a dedicated IP address for every domain.
How Does SNI Work?
When a client (for example, a browser) connects to a website, it first sends a ClientHello message asking the server to initiate an encrypted connection.
Without SNI, the server doesn’t know which domain the client expects a certificate for — so it serves a default one, which may not match the requested domain. This can cause browser warnings.
For example:
Without SNI:
openssl s_client -connect 192.168.1.1:443This connects to the server without specifying the domain name. The server responds with its default certificate, which often doesn’t match the domain — resulting in security warnings.
With properly configured SNI:
openssl s_client -connect 192.168.1.1:443 -servername www.example.comHere, the domain name is sent during the handshake. The server recognizes which certificate to use and provides the correct one for www.example.com, keeping the connection secure and trusted.
With SNI, the client sends the desired domain name in the initial ClientHello. The server then selects the appropriate certificate and establishes a secure connection.
Typical Web Server Configuration for SNI
Apache:
<VirtualHost *:443>
ServerName example.com
DocumentRoot /var/www/example
SSLEngine on
SSLCertificateFile /etc/ssl/certs/example.com.crt
SSLCertificateKeyFile /etc/ssl/private/example.com.key
</VirtualHost>
<VirtualHost *:443>
ServerName another-example.com
DocumentRoot /var/www/another-example
SSLEngine on
SSLCertificateFile /etc/ssl/certs/another-example.com.crt
SSLCertificateKeyFile /etc/ssl/private/another-example.com.key
</VirtualHost>Nginx:
server {
listen 443 ssl;
server_name example.com;
root /var/www/example;
ssl_certificate /etc/ssl/certs/example.com.crt;
ssl_certificate_key /etc/ssl/private/example.com.key;
}
server {
listen 443 ssl;
server_name another-example.com;
root /var/www/another-example;
ssl_certificate /etc/ssl/certs/another-example.com.crt;
ssl_certificate_key /etc/ssl/private/another-example.com.key;
}These configurations ensure the server uses SNI to deliver the correct certificate for each requested domain.
How Is the Server Name Transmitted in the TLS Protocol?
In TLS, the server name is transmitted via the Server Name Indication (SNI) extension during the very first step of the handshake.
The client sends a ClientHello message containing supported cryptographic standards and the requested domain name. This domain is embedded in the SNI extension field.
The server reads this value, selects the matching SSL/TLS certificate, and uses it to encrypt the connection — before the TLS handshake is completed. This ensures that the correct hostname is served from the very beginning.
Example of a ClientHello message with SNI:
Handshake Type: ClientHello
Version: TLS 1.2 (0x0303)
Random: ...
Session ID: ...
Cipher Suites: ...
Extensions:
Extension: server_name (len=14)
Type: server_name (0x0000)
Length: 14
Server Name Indication:
Hostname: www.example.comIn this example, the ClientHello includes the domain name www.example.com in the Extensions section, allowing the server to identify and return the correct SSL/TLS certificate.
I<aside> 💡
What if multiple names of the same type are communicated? Since the RFC specifies that the server name field is a list, multiple entries can theoretically be sent.
</aside>
Risks of Missing or Incorrect SNI Configuration
Without SNI, website operators risk not just user confusion, but also serious security issues:
- Phishing risk: Attackers could present a fake certificate to trick users into sharing sensitive data.
- Man-in-the-middle attacks: Without the correct certificate, the connection is vulnerable to eavesdropping or manipulation.
- Loss of trust: Visitors may receive browser warnings that the connection is not secure — a nightmare for any online business.
How to Detect Multiple Websites on a Server
To determine if a server hosts multiple websites, you can use tools like nslookup or dig to analyze DNS records. For example:
With nslookup:
nslookup www.example.com
This shows the IP address of www.example.com. You can then check which other domains share the same IP.
With dig:
dig www.example.com
This also returns the IP address, which can be further investigated.
With openssl s_client:
openssl s_client -connect www.example.com:443 -servername www.example.com
This command displays the certificate for the domain, including other domains listed in the SAN (Subject Alternative Name) field.
With sslscan:
sslscan www.example.comThis tool provides a list of all certificates served by the domain and can help identify additional hosted websites.
An IP address shared by multiple domains usually indicates shared hosting.
These tools make it easy to see which certificates a server provides via SNI — and how many websites share the same infrastructure.
Conclusion
Server Name Indication (SNI) is an invisible shield in the world of web security.
It not only enables efficient use of server resources but also preserves user trust.
In a time when cyberattacks are becoming increasingly sophisticated, SNI is an indispensable tool — for every organization, large or small.
