Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: 
 <CAKQ1sVPBxaHCMCzjf3p-pTpPhQk-dcrASvy6Zs-wgpqYD=YVXg@mail.gmail.com>
References: <6A48855E-B573-4946-8BC7-AE914B94BE90@greenbytes.de>
	<CAKQ1sVPBxaHCMCzjf3p-pTpPhQk-dcrASvy6Zs-wgpqYD=YVXg@mail.gmail.com>
Date: Wed, 10 Jun 2015 17:48:53 +0200
Message-ID: 
 <CAKQ1sVNcZZKfitUiKBX7BW_zGwJprOQ21Nv_xyVCu3mU+PKZdQ@mail.gmail.com>
Subject: Re: SNI Host: header mismatch
From: Yann Ylavic <ylavic.dev@gmail.com>
To: dev@httpd.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Jun 10, 2015 at 5:30 PM, Yann Ylavic <ylavic.dev@gmail.com> wrote:
> On Wed, Jun 10, 2015 at 4:41 PM, Stefan Eissing
> <stefan.eissing@greenbytes.de> wrote:
>> Today I had the second user which got "400 Bad Request" when using mod_h=
2 with a wildcard certificate. So, I was thinking how to possibly fix the c=
ode in mod_ssl.
>>
>> The mostly harmless approach is the addition of a configuration directiv=
e that admins may use to explicitly allow multiple host requests on a SNI c=
onnection. Which would mean that both the config of the SNI host and the co=
nfig of the request host have "SSLSNIVHostMatch off".
>>
>> The case where no Host header is provided or no SNI is used I propose to=
 leave unaffected, e.g. continue to fail.
>>
>> Any thoughts?
>
> Maybe matching against the ServerName and ServerAlias(es) instead of
> the Host header, so that the admin can still have a control on it...

E.g. by using ap_matches_request_vhost(r, SNI, 0).