Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: <CANpTS00vgXzY+ia2nDDNnJWBTtSkna7YTEgYET0T1zAgT8ctRQ@mail.gmail.com>
References: <CANpTS00vgXzY+ia2nDDNnJWBTtSkna7YTEgYET0T1zAgT8ctRQ@mail.gmail.com>
Date: Mon, 23 May 2016 09:39:27 -0400
Message-ID: <CALK=YjOpeYqGoO1B0=c6F2vZQEx5FXGgPiCDHDa8vnegr9EnRw@mail.gmail.com>
From: Eric Covener <covener@gmail.com>
To: users@httpd.apache.org
Content-Type: text/plain; charset=UTF-8
Subject: Re: [users@httpd] TLS 1.1 and 1.2 and SNI support
archived-at: Mon, 23 May 2016 13:39:39 -0000

On Mon, May 23, 2016 at 9:36 AM, linux.il <linux.il@gmail.com> wrote:
> As far as I see from my experiments (Apache 2.4.6 on RHEL7) and users
> reports, SNI needs TLS 1.0 and doesn't work with TLS1.1/1.2.
> This behavior seems me really weird; unfortunately I couldn't find any
> explanation for it.
> My question is: did I miss  something? Is there any way to use SNI w/o
> TLSv1?
> We want to disable TLS 1.0, but don't want to lost SNI functionality.
>
> URLs:
> - https://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI "The first
> (default) vhost for SSL name-based virtual hosts must include TLSv1 as a
> permitted protocol"
> -
> http://serverfault.com/questions/700143/does-sni-really-require-tlsv1-insecure
>
> TIA,
> Vitaly
> PS: I understand that my question is not 100% on-topic but I hope it's close
> enough.


All of those references are contrasting TLSv1 with SSLv3, not with
TLSv1.2.  SNI works fine with TLSv1.0 _and later_

-- 
Eric Covener
covener@gmail.com

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org