You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "tom5897 (via GitHub)" <gi...@apache.org> on 2025/02/17 08:53:26 UTC
[I] feat: As OCI user, I want to process empty ssl_server_name, so that I solve error [apisix]
tom5897 opened a new issue, #11972:
URL: https://github.com/apache/apisix/issues/11972
### Description
In OCI load balancer, Oracle, MTLS is not supported between OCI load balancer to backend server.
https://docs.oracle.com/en-us/iaas/Content/Balance/Tasks/managinglisteners_topic-Creating_Listeners.htm
So, I met error by empty SSL SNI($ssl_server_name in nginx).
[lua] init.lua:185: http_ssl_client_hello_phase(): failed to find SNI: please check if the client requests via IP or uses an outdated protocol. If you need to report an issue, provide a packet capture file of the TLS handshake., context: ssl_client_hello_by_lua*
If SSL SNI is empty, I want to use another variable, like hostname, $host for solving this error.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As user, I want to process empty ssl_server_name, so that I solve error [apisix]
Posted by "bzp2010 (via GitHub)" <gi...@apache.org>.
bzp2010 commented on issue #11972:
URL: https://github.com/apache/apisix/issues/11972#issuecomment-2676347446
The $host variable won't exist until a TLS connection is established (complete with handshake), and the connection has already been rejected and closed due to a empty SNI before then, so the scenario you mention isn't directly feasible.
We have another solution, check the fallback_sni entry in the config file.
This allows you to specify a default value when LB passes an empty SNI, which will solve your problem.
https://github.com/apache/apisix/blob/de7bd0bb47782f61e7b170c8d42a21b7daa5a001/conf/config.yaml.example#L111
Note that this is not complete, you must also configure an SSL resource for this specified SNI, which you secure the communication by using a self-signed certificate and trusting it on the LB.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As user, I want to process empty ssl_server_name, so that I solve error [apisix]
Posted by "tom5897 (via GitHub)" <gi...@apache.org>.
tom5897 commented on issue #11972:
URL: https://github.com/apache/apisix/issues/11972#issuecomment-2677567232
I understand that SSL SNI variable is an essential.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] feat: As user, I want to process empty ssl_server_name, so that I solve error [apisix]
Posted by "tom5897 (via GitHub)" <gi...@apache.org>.
tom5897 closed issue #11972: feat: As user, I want to process empty ssl_server_name, so that I solve error
URL: https://github.com/apache/apisix/issues/11972
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org