Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: <6A48855E-B573-4946-8BC7-AE914B94BE90@greenbytes.de>
References: <6A48855E-B573-4946-8BC7-AE914B94BE90@greenbytes.de>
Date: Wed, 10 Jun 2015 17:30:26 +0200
Message-ID: 
 <CAKQ1sVPBxaHCMCzjf3p-pTpPhQk-dcrASvy6Zs-wgpqYD=YVXg@mail.gmail.com>
Subject: Re: SNI Host: header mismatch
From: Yann Ylavic <ylavic.dev@gmail.com>
To: dev@httpd.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

On Wed, Jun 10, 2015 at 4:41 PM, Stefan Eissing
<stefan.eissing@greenbytes.de> wrote:
> Today I had the second user which got "400 Bad Request" when using mod_h2=
 with a wildcard certificate. So, I was thinking how to possibly fix the co=
de in mod_ssl.
>
> The mostly harmless approach is the addition of a configuration directive=
 that admins may use to explicitly allow multiple host requests on a SNI co=
nnection. Which would mean that both the config of the SNI host and the con=
fig of the request host have "SSLSNIVHostMatch off".
>
> The case where no Host header is provided or no SNI is used I propose to =
leave unaffected, e.g. continue to fail.
>
> Any thoughts?

Maybe matching against the ServerName and ServerAlias(es) instead of
the Host header, so that the admin can still have a control on it...