All files from this thread

File Name	File Size		Posted by	Date
linkedin.png	655 bytes	open | download	mike-pt	10/15/2014	Read message
linkedin.png	655 bytes	open | download	mike-pt	10/16/2014	Read message

Hello!

On Fri, Nov 07, 2014 at 04:23:58AM -0500, saravsars wrote:

> Hello
>
> >When using SSLv3 to connect, settings of the default server{}
> >block will be used. This is because there is no SNI in SSLv3, and
> >hence SSL connection is established in the context of the default
> >server{} block
>
> Even with TLSv1.1 and TLSv1.2, default server "ssl_protocols" is only in
> effect.

In theory, this depends on the OpenSSL library behaviour and may
work as long as SNI is used - nginx does it's best to update all
SSL options on SNI callback.

With current OpenSSL code it doesn't seem to work though, as
protocols allowed are checked before SNI callback happens and not
rechecked afterwards. So yes, you are right - "ssl_protocols"
won't do anything good in non-default server{} blocks, even if SNI
is used.

--
Maxim Dounin
http://nginx.org/

_______________________________________________
nginx mailing list
nginx@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx