Home / server / Questions / 671962
Accepted
oucil
Asked: 2015-02-28 10:42:40 +0800 CST

SNI for multi tenant load balancing in 2015

  • 772

We're a multi-tenant service and terminate our SSL at our load balancers (HAProxy + Apache for SSL termination), this has caused growing pains due to dedicated IP requirements. But times have changed and we're considering moving to SNI so I was hoping for educated opinions for 2015 about adopting it as our standard.

I'm going to outline our assumptions:

  • SSL is dead (long live TLS) due to the POODLE attack,
  • TLS has SNI built in
  • IE6 / Windows XP ( < sp3) are dead for many reasons, not the least of which is XP going EOL
  • We've terminated support for IE7 and essentially IE8 at this point

Am I correct in assuming that SNI is essentially globally supported now?

... and ...

Are there scenarios that I should consider beyond this that would affect support?

... and finally ...

Now that HAProxy 1.5 supports SSL Termination directly, are there any caveats in your experience directly relating to SNI that will affect our ability to roll out this service?

ssl

2 Answers

  1. Best Answer

    Am I correct in assuming that SNI is essentially globally supported now?

    If you consider browsers - yes.

    If you have to deal with other kind of applications - not really:

    • Python 3 has support, but Python 2.7. got only support with the just released version 2.7.9
    • Android has limited support. The HTTPUrlConnection had support for a long time, but the SDK contained an old version of Apache HTTPClient for the more advanced stuff and this version did not support SNI. I don't know if the situation changed with the latest SDK.
    • Java got support only with JDK 1.7
    • There are still some crawlers for search engines out there which don't support SNI. According to https://www.mnot.net/blog/2014/05/09/if_you_can_read_this_youre_sniing this contained in 05/2014 Bing, Yahoo, Baidu and others.
    • 2

  2. Am I correct in assuming that SNI is essentially globally supported now?

    Essentially, yes - though you'll likely run into some edge case users who will complain about brokenness if SNI is required. If you have the capability to tell those people "use a browser from this decade, please" for your service, then you're set.

    Are there scenarios that I should consider beyond this that would affect support?

    Browser/client OS support are the big ones, though I can imagine some other fun problems with corporate networks using SSL terminating proxies that don't support passing the SNI part of the TLS handshake, which would also break SNI.

    Now that HAProxy 1.5 supports SSL Termination directly, are there any caveats in your experience directly relating to SNI that will affect our ability to roll out this service?

    I can't speak directly to caveats with HAProxy - we're using its SSL termination but not SNI on top of it.

    • 1