Please enable JavaScript.

Coggle requires JavaScript to display documents.

Name-based virtual hosting (sometimes called host-based or shared virtual…

- - - - (HTTPS only)
        ClientHello (SNI = siteB.com) → server picks siteB’s certificate.
        
        HTTP request
        GET / HTTP/1.1
        Host: siteB.com
        
        Vhost routing
        server { server_name siteB.com; root /var/www/siteB; }
        
        Response
        Correct HTML/CSS/JS for siteB is returned.
  - - - Once the hostname is known, the web server routes the request to the matching virtual-host block (vhost) and serves the correct files, runs the right application, applies the right access rules, and writes to the right log—all while the underlying CPU, RAM, and network stack are shared among all sites on the box.
- - - - • With plain HTTP you first open a TCP connection, then send your request line and the Host header.
      - • The server receives the Host header and knows which virtual host (site) to serve.
      - • With HTTPS, the HTTP request (including the Host header) is encrypted.
      - • BUT the server must choose and send its TLS certificate before any encryption can start.
      - • If several sites on the same IP each have their own certificate, the server has to decide which certificate to send before it can read the Host header.
        
        How TLS solved it → SNI
        
        During the TLS handshake the client begins with a “ClientHello” message.
        
        • The SNI extension lets the client add:
        “I want to talk to www.example.com.”
        
        • Because the ClientHello itself is not encrypted, the server sees the requested hostname early enough.
        
        • The server now selects the matching certificate for www.example.com and continues the handshake.
        
        1 more item...