Background reasons:
SSL layer is actually the TCP / IP protocol layer between the application layer and the transport layer, HTTP has not yet reached this level, but it is located on top of TCP. We know, Nginx support multiple domain names on a single IP, reason is that, HTTP protocol, there is a field Host, by matching the value in this field and nginx.conf server_name each server segment, Nginx you can easily put forwards the request to the corresponding content server up.
But for HTTPS it does not work, why? Mentioned above, SSL is located between the HTTP protocol and TCP protocol, that is, a request comes in, the handshake stage, SSL does not know in the end is which request Host request. And you know Host, will need to decrypt HTTP requests, but this layer precisely to SSL encryption of HTTP. So he caught a chicken or the egg problem.
So with SNI fields: Server Name Indication, works in the SSL handshake stage browser extension field by SNI with the domain name to send information in the past. Nginx so you can serve multiple HTTPS service on one IP. But this technology has three requirements:
1, Nginx need to allow this to set at compile time, you can view by nginx -V
2, Nginx dynamically linked openssl To support this feature, you can also look through nginx -V, if no exceptions, which is to support, in addition openssl support this function from the start 0.9.8f
3, users use a browser that supports this feature
Measured results:
on Nginx configured with different domain names and the corresponding certificates, test the domain name www.huawei.com and www.syjhahaha.com.
1, if by -vk -H curl "the Host: www.syjhahaha.com" " https://10.93.167.110:443/test" https requests initiated, since no extension SNI field information, use the first Nginx a server segments (www.huawei.com) to match, using the information in the certificate and cipher suite support the server segment .
2, found that if a request to initiate a browser (e.g. Chrome), the domain name information may SNI field, an exact match to a specific server. That is, the domain name request www.syjhahaha.com can be matched to a corresponding server section (www.syjhahaha.com), using the certificate and cipher suite information corresponding to.