Glossary
Server Name Indication
Server Name Indication is a field a client sends at the very start of a TLS handshake, naming the hostname it is trying to reach. Without it a server hosting several sites on one address has no way to know which certificate to present, because the request that would have said so is itself encrypted. SNI resolves the ordering problem, and it is why a certificate error on one hostname and not another is almost always a configuration gap rather than an expired certificate.
The ordering problem it solves
A TLS handshake completes before any HTTP request is sent, which means the server must choose a certificate before it has been told which site is wanted.
With one site per address there is no ambiguity. With many sites on one address there is nothing to go on.
SNI puts the hostname in the first message of the handshake, so the server can select the matching certificate.
It is sent in the clear, which is a known privacy property: an observer learns which site is being visited even though the traffic is encrypted.
Encrypted variants of the mechanism exist and are not yet widely deployed.
Why a wrong certificate on one name is an SNI symptom
When a server receives a name it has no certificate for, it presents its default — typically the first site configured or a placeholder.
The browser sees a certificate that does not cover the name it asked for and refuses the connection.
The site is running, the certificate for it may well exist, and the server was never told to associate the two.
Which is why the error appears on exactly one hostname while every other name on the same server works.
A newly added subdomain, or a name added to a certificate without updating the server configuration, is the usual cause.
How it interacts with certificate coverage
A certificate covers a set of names listed in its subject alternative names, and a wildcard covers one level of subdomain.
SNI decides which certificate is presented; coverage decides whether that certificate is valid for the name.
Both must be right. A correct certificate selected for the wrong name fails, and so does the right name selected against a certificate that does not list it.
This is also why checking a certificate by address rather than by hostname produces misleading results — the address answers with whatever the default is.
A checker that does not send SNI is testing the default site, which on shared infrastructure is rarely the one anyone meant.
Where it matters beyond the web
Mail servers use the same mechanism, which is why an MTA-STS policy naming exchangers depends on those exchangers presenting the right certificate for their own names.
Content delivery networks rely on it entirely, since one edge address serves an enormous number of customer hostnames.
Load balancers terminating TLS need each name configured, which is where a name added at the application layer and not at the balancer goes wrong.
Very old clients without SNI support exist and are effectively absent from modern traffic.
How it is observed
The certificate really presented for the hostname is retrieved, with the name sent in the handshake as a browser would send it.
Whether that certificate covers the hostname is checked against its subject alternative names.
The negotiated protocol version and cipher suite are recorded from the same handshake.
A certificate valid for a different name is reported as a coverage failure, which is the observable form the misconfiguration takes.
Frequently asked questions
- Why does my certificate work on one subdomain and not another?
- Almost always because the server has no certificate associated with the second name and falls back to its default. The certificate may exist; the server was not told to use it for that name.
- Does SNI leak which site I am visiting?
- Yes — it is sent before encryption is established, so an observer sees the hostname. The traffic itself stays encrypted, and encrypted variants of the mechanism are not yet widely deployed.
- Can I test a certificate by IP address?
- You will get the server's default certificate, which on shared infrastructure is rarely the one you meant to check. The hostname has to be sent in the handshake.
Sources
Related
VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.
Scan a website