# Proxy\_pass not seen as SNI-client according to Apache directive **URL:** \ **Category:** NGINX\ **Created:** [February 14, 2016, 8:14pm UTC](https://www.ruby-forum.com/t/proxy-pass-not-seen-as-sni-client-according-to-apache-directive/244065 "2016-02-14T20:14:56Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Rafa\_F](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/958977/32.png) [@Rafa\_F](https://www.ruby-forum.com/u/Rafa_F)\ **Post date:** [February 14, 2016, 8:14pm UTC](https://www.ruby-forum.com/t/proxy-pass-not-seen-as-sni-client-according-to-apache-directive/244065/1 "2016-02-14T20:14:56Z")
Hi guys, I’m having a rather odd behavior - I use nginx as a reverse proxy (basically as a CDN) - where if the file isn’t in cache, I do use proxy\_pass to the origin server, to get the file and then cache it. This works perfectly in most cases, but if the origin is running apache and happen to use the Apache Directive “SSLStrictSNIVHostCheck” where it’s set to On. Basically it decides whether a non-SNI client is allowed to access a name-based virtual host over SSL or not. But when using proxy\_pass this seems to the apache server that it’s a non-SNI client: [Sun Feb 14 19:32:50 2016] [error] No hostname was provided via SNI for a name based virtual host [Sun Feb 14 19:33:00 2016] [error] No hostname was provided via SNI for a name based virtual host I was able to replicate this issue on multiple nginx versions (both on 1.8.1, 1.9.9 and 1.9.10). It results in 403 forbidden for the client. If I set the directive SSLStrictSNIVHostCheck to off, I do not get a 403 forbidden - and the files I try to fetch gets fetched correctly. (Meaning proxy\_pass do understand SNI). The nginx zone does a proxy\_pass https://my\_domain; and the my\_domain is running on a server that runs SNI. Best Regards, Lucas Rolff ---
**Author:** ![Lucas\_Rolff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/34f0e0/32.png) [@Lucas\_Rolff](https://www.ruby-forum.com/u/Lucas_Rolff)\ **Post date:** [February 14, 2016, 9:58pm UTC](https://www.ruby-forum.com/t/proxy-pass-not-seen-as-sni-client-according-to-apache-directive/244065/2 "2016-02-14T21:58:55Z")
Hello! On Sun, Feb 14, 2016 at 08:14:20PM +0100, Lucas Rolff wrote: > I’m having a rather odd behavior - I use nginx as a reverse proxy (basically > as a CDN) - where if the file isn’t in cache, I do use proxy\_pass to the > origin server, to get the file and then cache it. > > This works perfectly in most cases, but if the origin is running apache and > happen to use the Apache Directive “SSLStrictSNIVHostCheck” where it’s set > to On. > **[Module ngx\_http\_proxy\_module](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_ssl_server_name)** > > The ngx\_http\_proxy\_module module allows passing requests to another server. – Maxim D. > **[nginx](http://nginx.org/)** ---
**Author:** ![Lucas\_Rolff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/34f0e0/32.png) [@Lucas\_Rolff](https://www.ruby-forum.com/u/Lucas_Rolff)\ **Post date:** [February 14, 2016, 10:47pm UTC](https://www.ruby-forum.com/t/proxy-pass-not-seen-as-sni-client-according-to-apache-directive/244065/3 "2016-02-14T22:47:24Z")
> > This works perfectly in most cases, but if the origin is running apache and > > happen to use the Apache Directive “SSLStrictSNIVHostCheck” where it’s set > > to On. > > [Module ngx\_http\_proxy\_module](http://nginx.org/r/proxy_ssl_server_name) Out of curiosity, is there a philosophical/design reason this option is not enabled by default? ---
**Author:** ![Lucas\_Rolff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/34f0e0/32.png) [@Lucas\_Rolff](https://www.ruby-forum.com/u/Lucas_Rolff)\ **Post date:** [February 14, 2016, 10:52pm UTC](https://www.ruby-forum.com/t/proxy-pass-not-seen-as-sni-client-according-to-apache-directive/244065/4 "2016-02-14T22:52:39Z")
Hi Maxim, Thank you a lot for the quick reply, I’ll give it a test tomorrow morning! And Robert has a valid point indeed, why is it actually disabled by default? ---
**Author:** ![Lucas\_Rolff](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/34f0e0/32.png) [@Lucas\_Rolff](https://www.ruby-forum.com/u/Lucas_Rolff)\ **Post date:** [February 15, 2016, 3:17am UTC](https://www.ruby-forum.com/t/proxy-pass-not-seen-as-sni-client-according-to-apache-directive/244065/5 "2016-02-15T03:17:17Z")
Hello! On Sun, Feb 14, 2016 at 01:46:48PM -0800, Robert P. wrote: > > > This works perfectly in most cases, but if the origin is running apache and > > > happen to use the Apache Directive “SSLStrictSNIVHostCheck” where it’s set > > > to On. > > > > [Module ngx\_http\_proxy\_module](http://nginx.org/r/proxy_ssl_server_name) > > Out of curiosity, is there a philosophical/design reason this > option is not enabled by default? There was no support for client-side SNI till nginx 1.7.0, and when introduced it was set off by default to avoid breaking existing configurations. Additionally, client-side SNI discloses information about domain name used to connect to (which is bad from security point of view), and hardly make sense without peer certificate verification ([Module ngx\_http\_proxy\_module](http://nginx.org/r/proxy_ssl_verify)), which is also off by default and can’t be enabled without a list of trusted certificates. – Maxim D. > **[nginx](http://nginx.org/)**