What does this notice mean "SNI: extension not received from the client", in stunnel log

Question

I am working on multiple domain certificates using stunnel. I have two domains test.int and test1.int and given multiple certificates to each domain and one default certificate. I used sni option of stunnel to provide multiple domain certificates. Using javascript websocket i am trying to connect to secure server, But log file output shows

SNI: extension not received from the client

So i am not sure about sni option supports or not. Could any one help me to explain its working or not. What is the meaning of "SNI: extension not received from the client" statement.

Thanks in advance for your valuable answers.

My stunnel.config file

output=/var/log/stunnel.log
pid=
debug = 7
fips = no
compression = rle

options = NO_SSLv2

syslog = no

[websockets]
cert = /usr/local/etc/stunnel/default.crt
key = /usr/local/etc/stunnel/default.key
accept  = 0.0.0.0:9443
connect = 127.0.0.1:9000


[sni1]
sni = websockets:mailxf.test.int
cert = /usr/local/etc/stunnel/test.int.crt
key = /usr/local/etc/stunnel/test.int.key
connect = 127.0.0.1:9000

[sni2]
sni = websockets:mailxf.test1.int
cert = /usr/local/etc/stunnel/test1.int.crt
key = /usr/local/etc/stunnel/test1.int.key
connect = 127.0.0.1:9000

Log file output

Service [websockets] accepted (FD=9) from 192.168.0.132:38257
2014.04.14 18:30:32 LOG7[7085:139648669734672]: Service [websockets] started
2014.04.14 18:30:32 LOG5[7085:139648669734672]: Service [websockets] accepted connection from 192.168.0.132:38257
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): before/accept initialization
**2014.04.14 18:30:32 LOG5[7085:139648669734672]: SNI: extension not received from the client**
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 read client hello A
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 write server hello A
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 write change cipher spec A
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 write finished A
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 flush data
2014.04.14 18:30:32 LOG7[7085:139648669734672]: SSL state (accept): SSLv3 read finished A
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    2 items in the session cache
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 client connects (SSL_connect())
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 client connects that finished
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 client renegotiations requested
2014.04.14 18:30:32 LOG7[7085:139648669734672]:   19 server connects (SSL_accept())
2014.04.14 18:30:32 LOG7[7085:139648669734672]:   19 server connects that finished
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 server renegotiations requested
2014.04.14 18:30:32 LOG7[7085:139648669734672]:   14 session cache hits
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 external session cache hits
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    0 session cache misses
2014.04.14 18:30:32 LOG7[7085:139648669734672]:    2 session cache timeouts
2014.04.14 18:30:32 LOG6[7085:139648669734672]: SSL accepted: previous session reused
2014.04.14 18:30:32 LOG6[7085:139648669734672]: connect_blocking: connecting 127.0.0.1:9000
2014.04.14 18:30:32 LOG7[7085:139648669734672]: connect_blocking: s_poll_wait 127.0.0.1:9000: waiting 10 seconds
2014.04.14 18:30:32 LOG5[7085:139648669734672]: connect_blocking: connected 127.0.0.1:9000
2014.04.14 18:30:32 LOG5[7085:139648669734672]: Service [websockets] connected remote server from 127.0.0.1:44325
2014.04.14 18:30:32 LOG7[7085:139648669734672]: Remote socket (FD=10) initialized

Javascript code to connect secure server,

wss://mailxf.test.int:9443/bo/socket.bo.php

I am using webbrowser version as Chrome 26 and firefox 24 and OS version centos 6.

It would probably be helpful if you included a few lines of the JavaScript you use to instantiate and connect with a secure WebSocket — Mathias R. Jessen, Apr 14 '14 at 14:46
Are you sure this syntax is correct: `sni = websockets:mailxf.test.int`? — David Schwartz, Apr 15 '14 at 06:08
@DavidSchwartz yes, syntax is right : This syntax referred from given link, https://www.stunnel.org/pipermail/stunnel-users/2011-June/003132.html — Kaustubh Khare, Apr 15 '14 at 06:18
The meaning of the statement is that your client is not supporting SNI. — Jenny D, Apr 15 '14 at 06:19

score 1 · Accepted Answer · answered Apr 15 '14 at 04:53

1

You tried to connect directly to an IP address, rather than a hostname. So there wouldn't be any point to SNI, as you didn't provide a name. You're meant to use the hostname.

For instance:

wss://example.com:9443/bo/socket.bo.php

answered Apr 15 '14 at 04:53

Michael Hampton

237,123
42
477
940

i edited my question and add host name instead of ip address, but same notice line present in log file. – Kaustubh Khare Apr 15 '14 at 05:30
Internally server was reading ip address instead of hostname. Now I changed configurations, ip replaced by hostname. Its working now. Thank you very much. – Kaustubh Khare Apr 15 '14 at 07:29

What does this notice mean "SNI: extension not received from the client", in stunnel log

1 Answers1