Networking Essentials medium
Before SNI, a server could only host one SSL certificate per IP address. How does SNI solve this?
- A The client includes the target hostname in the initial unencrypted TLS 'ClientHello' message, allowing the server to select and present the correct certificate.
- B It configures multiple virtual IP addresses on a single physical network interface card (NIC) to ensure that every unique domain has a dedicated routing path.
- C The protocol utilizes standard HTTP Host headers to determine the server's identity before the initial encrypted TLS handshake has been formally established.
- D The server uses a massive 'Wildcard' certificate that is mathematically verified to represent every possible domain name hosted on a specific physical subnet.
Answer: A. The client includes the target hostname in the initial unencrypted TLS 'ClientHello' message, allowing the server to select and present the correct certificate.
Normally, a server presents its SSL/TLS certificate *before* it knows which domain the user wants (the HTTP 'Host' header is only sent after encryption is established). This worked fine when every domain had its own IP address. However, IP addresses are scarce. SNI (Server Name Indication) allows a single IP to host thousands of secure sites. The client simply whispers the hostname during the initial unencrypted greeting. While this solves the 'one-cert-per-IP' limit, it does create a privacy risk in TLS 1.2, as anyone monitoring the network can see exactly which website you are visiting by looking at the unencrypted SNI field.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- What is the downside of enabling 'Sticky Sessions' (Session Affinity) on a Load Balancer?
- In WebRTC (P2P Mesh), why is a STUN server required?
- What is the fundamental difference between a Network Switch and a Router?
- In Cloud Networking (AWS), what is the limitation of VPC Peering compared to a Transit Gateway?
- Which protocol is ideal for real-time multiplayer gaming positions or Voice over IP (VoIP), and why?
- What is the purpose of the 'Time To Live' (TTL) field in an IP packet?