Server Name Indication
WebSEAL can use Server Name Indication to identify the host name in the request and send a server certificate that contains a matching host name. We can configure the certificate that WebSEAL uses for each host.
Server Name Indication is an extension to the SSL and TLS protocols. Server Name Indication identifies the host name to which the browser is requesting a connection.
By default, WebSEAL sends the same certificate to all hosts. However, by using Server Name Indication, WebSEAL can send a different certificate for each requested host.
To support Server Name Indication, the request must meet the following requirements:
- Use TLS over SSL to connect to WebSEAL. SSLv2 and SSLv3 are not supported.
- Use a browser that supports Server Name Indication.
Use the webseal-cert-keyfile-sni configuration entry in the [ssl] stanza of the WebSEAL configuration file to specify the certificate that WebSEAL sends for a particular host name. For example:
[ssl] webseal-cert-keyfile-sni = <host_name>:<label>where:
- <host_name>
- The name of the host to which WebSEAL returns the certificate.
- <label>
- The name of the certificate for WebSEAL to use. Specify the certificate that contains a dn value of cn=<host_name>.
We can specify this configuration entry multiple times. Specify a separate entry for each server certificate.
If WebSEAL does not find an entry for the host name in the browser request, WebSEAL sends the default certificate specified by the webseal-cert-keyfile-label entry. WebSEAL also uses the default certificate if the request does not meet the Server Name Indication requirements. For example, if the browser does not support Server Name Indication.
If we do not configure webseal-cert-keyfile-sni entries, WebSEAL can send only a single certificate, which means that WebSEAL cannot differentiate between different hosts. A certificate mismatch error results in the browser when a user uses SSL to connect to a host that does not match the default certificate.
Server Name Indication solves this problem. Use the webseal-cert-keyfile-sni to configure WebSEAL to provide a matching certificate for each host name.
Parent topic: Configuration of the WebSEAL key database file