Server Name Indication (SNI) (Explained by Example)

[@efimovta]

Thanks!

[@efimovta]

There are so many cool content on the channel. Unbelievable! My first donate in my life starts with it.

[@FarazAliZuberi]

Dude you're a legend 😂 hilarious and fun.. keep up the good work.. learnt a lot. Subscribed..

[@hnasr]

Thanks Faraz 😊 glad you enjoyed the content and welcome to the community 🙏

[@rakeshkala7042]

seriously man, your videos are damn good. Full of technicalities with fun, btw liked your Arabic accent 🤣

[@kumarchitta]

Dude, this is awesome 👍 like the way you make it fun and interesting and to the point. Great work my friend.

[@luispuentes6392]

This explanation is so nice. Thanks!

[@hnasr]

Appreciate it! Thanks

[@jackedelic9188]

I never knew about an ip address being able to serve multiple domain names. I just double checked by typing in an existing ip address (instead of its domain name) and got 404. I felt cheated at the end of my 4 year CS education.

[@hnasr]

Yup! connecting through IP is not enough for the server as it doesn’t know which domain / website you want.. some Websites might put defaults though

[@ritwickdey97]

Hi, how HAProxy knows which cert should to send to the client for "ali", "mark" or "jenny" backend? Does it try to match backend name & cert name?

[@hnasr]

Excellent question, during client hello in TLS the client sends the host name it tries to connect. HAProxy takes that host name and match it against each of the three certificate because the certificate has the hostname. And sends the appropriate one that matches. This is called SNI (Server Name Indication)

[@ritwickdey97]

@@hnasr Okk. I got it..

[@chengdongliao9875]

Thanks for your effort to make this awosome video!

[@hnasr]

Chengdong Liao thanks for your comment dear 😊

[@abulaith4485]

Wow, great technical video on mutlisite hosting on 1 IP address, even though you confused the hell out of me :-o) LOL

[@blypt]

Funny Voice of Dad :) :)

[@palaniappanrm6277]

Hi. Few doubts as always. 1. After you did set up everything and made sure all 3 websites working fine with 1 public ip using SNI, now what will happen if I just specify the public ip address in the browser rather than a domain name? Which content it'll return back? 2. ESNI needs public key to be present in the DNS entry. The public key you mention here is the public key of HAProxy server right? If so, what configuration changes required in .cfg file for the same?

[@hnasr]

Palaniappan RM i can see your knowledge is growing with every question you ask! Which is awesome For 1) if you only specify ip address the host SNI will be blank and the SNI handshake will fail on the server.. it is up to the server to serve a default certificate when no host is provided..

[@hnasr]

Answer for q2) the public key on the DNS has a matching private key on HAProxy.. So the client will do DNS get public key encrypted the SNI do tls hello .. and server will decrypt the SNI and look at the host..

[@palaniappanrm6277]

@@hnasr we don't have to do any other configuration in HAProxy config file for this private key decryption during TLS hello to work?

[@AhmedAymanElSayed-e1i]

Thanks for the video. Very informative and fun 😉. I had a question regarding ESNI, when the public is key is used to encrypt the TLS handshake. Which private key will the server use for decryption? Like in your example will it be Ali, Jenny, Mark or a default one?

[@HarshKapadia]

For ESNI, how is the public key of the target domain encrypted when it is sent to the server?

[@hnasr]

The public key is encrypted as part of the DoH connection between the client and the DNS resolver.

[@brod515]

33:14 I'm confused here. if you make a query to the DNS for a particular domain, then it is already visible. anyone can see you making that request. Edit: 😂spoke too soon I see you address it after.

[@brod515]

what is the difference between just using NodeJS vs using haproxy (I don't know what haproxy is)?

[@AnasLoubadi]

think of ha proxy as a load balancer that receive request and forward them to backend servers

[@asd848]

So this isn't possible without a proxy? You couldn't use SNI, let's say, on a Node server alone?

[@hnasr]

Of course if that web server supports SNI, caddy and nginx comes to mind

[@MelviHunzaiFamily]

how i can make a sni account or sign up on sni

[@hnasr]

safder karim There is no account for SNI, You can just create multiple domains and use the proxy to configure it as I explained in the video

[@abdulsamihamedi5584]

can i create smart DNS proxy with this method ?

[@shikamigreg5490]

how can i configure this on an android phone?

[@hnasr]

this is a pure backend concept, nothing to do in the client except providing the SNI parameter which most SSL libraries do

[@shikamigreg5490]

thanks for the reply, can you make a detailed tutorial on how to correctly configure httpinjector ehi files on android phones to bypass isp for free net?

[@chebalid7524]

Hey ..nice stuff.. I wanna ask.. Can u instruct haproxy to accept any random sni

[@hnasr]

Hmm you can with scripts assuming you have the certificates for each domain requested

[@chebalid7524]

@@hnasr Ok.. Let say I have my.website.com hosted and running fine with a certificate generated...and in haproxy I set the host name let's say to www.google.com ...and make sure the client hello will have www.google.com in the host header.. Will the tls connection be established???? Hope u understand what I mean..

[@hnasr]

The TLS will fail on client because the certificate verification will fail since my.website is not google.com .. The TLS can be successful if client decided to ignore certificate verification example in curl -insecure or in browsers clicking “I understand the risk”

[@chebalid7524]

@@hnasr Wooow.. Thanks . You just made it clear to me..

[@Twowheeleetales]

How can i capture android app sni

[@voidthat]

hey this is a video explaining whats sni is and it is not a video about finding sni -_-

[@seeebscraib8465]

from where hussin

[@lukeb0030]

at 1.5x speed, this presentation is pretty HekTik

[@natesh1]

Hi you forgot to reference the videos in this....

[@hnasr]

Natesh M Bhat thanks for letting me know! Do you know where timestamp? It would make it easier for me 😊

[@somebody3014]

27:00

[@seeebscraib8465]

انت منيين يا حسيين

[@seeebscraib8465]

يخربييتك مفهمتش حاجة هههههههههه