blocks|key|375565|text|您可以安装草莓Perl，然后使用以下脚本模拟不支持SNI的客户端：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|375566|use+strict;
use+warnings;
use+LWP::UserAgent;

my+$ua+=+LWP::UserAgent->new(ssl_opts+=>+{
++++#+this+disables+SNI
++++SSL_hostname+=>+'',+
++++#+These+disable+certificate+verification,+so+that+we+get+a+connection+even
++++#+if+the+certificate+does+not+match+the+requested+host+or+is+invalid.
++++#+Do+not+use+in+production+code+!!!
++++SSL_verify_mode+=>+0,
++++verify_hostname+=>+0,
});

#+request+some+data
my+$res+=+$ua->get('https://example.com');

#+show+headers
#+pseudo+header+Client-SSL-Cert-Subject+gives+information+about+the
#+peers+certificate
print+$res->headers_as_string;

#+show+response+including+header
#+print+$res->as_string;|code-block|syntax|javascript|375567|通过将SSL_hostname设置为空字符串，您可以禁用SNI，禁用该行再次启用SNI。|375568|entityMap|0|LINK|mutability|MUTABLE|url|http://strawberryperl.com/^0|5|6|0|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@$A|T|B|U|1|V]]|C|$]]|$1|D|3|E|5|F|7|W|8|@]|9|@]|C|$G|H]]|$1|I|3|J|5|6|7|X|8|@]|9|@]|C|$]]|$1|K|3|-4|5|6|7|Y|8|@]|9|@]|C|$]]]|L|$M|$5|N|O|P|C|$Q|R]]]]

You could install <a href="http://strawberryperl.com/" rel="nofollow">Strawberry Perl</a> and then use the following script to simulate a client not supporting SNI:

<pre><code>use strict;
use warnings;
use LWP::UserAgent;

my $ua = LWP::UserAgent-&gt;new(ssl_opts =&gt; {
 # this disables SNI
 SSL_hostname =&gt; '', 
 # These disable certificate verification, so that we get a connection even
 # if the certificate does not match the requested host or is invalid.
 # Do not use in production code !!!
 SSL_verify_mode =&gt; 0,
 verify_hostname =&gt; 0,
});

# request some data
my $res = $ua-&gt;get('https://example.com');

# show headers
# pseudo header Client-SSL-Cert-Subject gives information about the
# peers certificate
print $res-&gt;headers_as_string;

# show response including header
# print $res-&gt;as_string;
</code></pre>

By setting SSL_hostname to an empty string you can disable SNI, disabling this line enables SNI again.

blocks|key|2190240|text|您可以使用最常用的SSL库OpenSSL。Windows二进制文件可供下载。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2190241|openssl+s_client+-connect+domain.com:443命令可以很好地测试来自客户端的SSL连接。在默认情况下，它不支持SNI。您可以附加-servername+domain.com参数以启用SNI。|offset|length|style|CODE|2190242|entityMap^0|0|0|14|29|M|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@$D|L|E|M|F|G]|$D|N|E|O|F|G]]|9|@]|A|$]]|$1|H|3|-4|5|6|7|P|8|@]|9|@]|A|$]]]|I|$]]

You can use the most commonly used SSL library, OpenSSL. Windows binaries are available to download.

<code>openssl s_client -connect domain.com:443</code> command serves very well to test SSL connection from client side. It doesn't support SNI by default. You can append <code>-servername domain.com</code> argument to enable SNI.

blocks|key|2190290|text|使用一个特殊的默认web应用程序的方法根本行不通。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2190291|你不能这样做，因为说有限的客户不只是打开一个不同的页面，但他们完全失败。|2190292|假设您有一个“默认”vhost，非SNI客户端将打开它。|ordered-list-item|2190293|您还有一个额外的vhost，它应该由支持SNI的客户端打开。|2190294|显然，这两者必须有不同的主机名(例如，default.example.com和www.example.com)，否则Apache或nginx将不知道显示到哪个连接客户端的站点。|offset|length|style|CODE|2190295|现在，如果一个非SNI客户端试图打开https://www.example.com，他将收到来自default.example.com的证书，这将给他一个证书错误。这是一个重要的警告。|2190296|解决此错误的一个方法是制作包含www.example.com和default.example.com的SAN+(多域)证书。然后，如果一个非SNI客户端试图打开https://www.example.com，他将得到一个有效的证书，但即使这样，他的Host:头仍然指向www.example.com，他的请求将被路由到www.example.com而不是default.example.com。|2190297|如您所见，要么完全阻止非SNI客户端，要么将它们转发到预期的vhost。默认web应用程序没有合理的选择.|BOLD|2190298|entityMap^0|0|0|0|0|J|J|13|F|0|I|N|1C|J|0|F|F|V|J|28|N|3G|5|3Q|F|4F|F|4X|J|0|10|H|0^^$0|@$1|2|3|4|5|6|7|X|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Y|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|Z|8|@]|9|@]|A|$]]|$1|G|3|H|5|F|7|10|8|@]|9|@]|A|$]]|$1|I|3|J|5|F|7|11|8|@$K|12|L|13|M|N]|$K|14|L|15|M|N]]|9|@]|A|$]]|$1|O|3|P|5|6|7|16|8|@$K|17|L|18|M|N]|$K|19|L|1A|M|N]]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1B|8|@$K|1C|L|1D|M|N]|$K|1E|L|1F|M|N]|$K|1G|L|1H|M|N]|$K|1I|L|1J|M|N]|$K|1K|L|1L|M|N]|$K|1M|L|1N|M|N]|$K|1O|L|1P|M|N]]|9|@]|A|$]]|$1|S|3|T|5|6|7|1Q|8|@$K|1R|L|1S|M|U]]|9|@]|A|$]]|$1|V|3|-4|5|6|7|1T|8|@]|9|@]|A|$]]]|W|$]]

The approach of using a special default web application simply would not work.

You can't do that because said limited clients not just open a different page, but they fail completely. 

<ol>
<li>Consider you have a "default" vhost which a non-SNI client will open just fine.</li>
<li>You also have an additional vhost which is supposed to be open by an SNI-supporting client.</li>
<li>Obviously, these two must have different hostnames (say, <code>default.example.com</code> and <code>www.example.com</code>), else Apache or nginx wouldn't know which site to show to which connecting client.</li>
</ol>

Now, if a non-SNI client tries to open <code>https://www.example.com</code>, he'll be presented a certificate from <code>default.example.com</code>, which would give him a certificate error. This is a major caveat.

A fix for this error is to make a SAN (multi-domain) certificate that would include both <code>www.example.com</code> and <code>default.example.com</code>. Then, if a non-SNI client tries to open <code>https://www.example.com</code>, he'll be presented with a valid certificate, but even then his <code>Host:</code> header would still point to <code>www.example.com</code>, and his request will get routed not to <code>default.example.com</code> but to <code>www.example.com</code>.

As you can see, you either block non-SNI clients completely or forward them to an expected vhost. There's no sensible option for a default web application.

blocks|key|375670|text|类似于openssl，s_client是gnutls-cli。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|375671|gnutls-cli+--disable-sni+www.google.com|code-block|syntax|javascript|375672|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Similar to openssl s_client is gnutls-cli

<pre><code>gnutls-cli --disable-sni www.google.com
</code></pre>

blocks|key|1671524|text|如果您使用的是OpenSSL+1.1.0或更早版本，请使用openssl+s_client+-connect+$ip:$port，OpenSSL将不启用SNI扩展|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1671525|如果使用的是OpenSSL+1.1.1，则需要向openssl+s_client添加-noservername标志。|1671526|entityMap^0|T|Z|0|O|G|16|D|0^^$0|@$1|2|3|4|5|6|7|J|8|@$9|K|A|L|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|M|8|@$9|N|A|O|B|C]|$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|H|3|-4|5|6|7|R|8|@]|D|@]|E|$]]]|I|$]]

If you are using OpenSSL 1.1.0 or earlier version, use <code>openssl s_client -connect $ip:$port</code>, and OpenSSL wouldn't enable the SNI extension

If you are using OpenSSL 1.1.1, you need add <code>-noservername</code> flag to <code>openssl s_client</code>.

blocks|key|375716|text|使用Java客户端，您可以通过设置系统属性jsse.enableSNIExtension=false来禁用SNI扩展。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|375717|这里有更多信息：Java+:在客户端握手时禁用SNI|375718|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/64025494/java-tls-disable-sni-on-client-handshake/64028075^0|L|T|0|8|I|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@$9|Q|A|R|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|S|8|@]|D|@$9|T|A|U|1|V]]|E|$]]|$1|H|3|-4|5|6|7|W|8|@]|D|@]|E|$]]]|I|$J|$5|K|L|M|E|$N|O]]]]

With a Java HTTP client you can disable the SNI extension by setting the system property <code>jsse.enableSNIExtension=false</code>.
More here: <a href="https://stackoverflow.com/questions/64025494/java-tls-disable-sni-on-client-handshake/64028075">Java TLS: Disable SNI on client handshake</a>

I'm setting up Apache with several distinct SSL certificates for different domains that reside on the same server (and thus sharing the same IP address).

With <a href="https://www.ssllabs.com/ssltest/index.html" rel="noreferrer">Qualys SSL Test</a> I discovered that there are clients (i.e. <a href="https://www.ssllabs.com/ssltest/viewClient.html?name=BingBot&amp;version=Dec%202013" rel="noreferrer">BingBot as of december 2013</a>) that do not support the SNI extension.

So I'm thinking about crafting a special default web application that can gather the requests of such clients, but how can I simulate those clients?

I'm on Windows 8, with no access to Linux boxes, if that matters.

How to simulate non-SNI browsers (without SNI support)?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

我正在为驻留在同一服务器上的不同域设置几个不同的SSL证书(从而共享相同的IP地址)。使用，我发现有些客户端(即)不支持SNI扩展。因此，我正在考虑制作一个特殊的默认web应用程序，它可以收集这些客户端的请求，但是我如何模拟这些客户机呢？我在Windows 8上，如果这重要的话，我没有访问Linux机器的权限。

问如何模拟非SNI浏览器(没有SNI支持)？
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何模拟非SNI浏览器(没有SNI支持)？EN