If multiple websites are hosted on a single server with the same IP address, you must specify the SNI (Server Name Indication) when points of presence (POPs) retrieve content from the origin server over HTTPS. The origin server returns the Secure Sockets Layer (SSL) certificate of the desired domain name based on the configured SNI to ensure the correct resources are returned.
Background information
SNI is an extension to SSL/TLS by which a client determines which hostname it attempts to connect to at the beginning of the handshake process. SNI allows a server to present multiple SSL certificates on the same IP address. After you configure an SNI, the origin server checks the SNI information carried in the TLS handshake request initiated by an Edge Security Acceleration (ESA) POP to determine the requested domain name. Then, the origin server returns the SSL certificate of the requested domain name to the ESA POP.
The origin server must support the parsing of the SNI information carried in a TLS handshake request.
The following figure shows how origin SNI works:
SNI works based on the following process:
When an ESA POP accesses the origin server over HTTPS, you must specify the desired domain name in the SNI. Sample domain name: example.com.
The origin server returns the matching certificate based on the SNI.
The ESA POP establishes a TLS connection with the origin server after receiving the certificate.
NoteThe origin SNI is the same as the origin host by default. You can configure the origin SNI by the following steps.
Create an origin SNI rule
Log on to the ESA console.
In the left-side navigation pane, click Websites.
On the Websites page, find the website that you want to manage, and click the website name or View Details in the Actions column.
In the left-side navigation pane, choose .
Click Create Rule and enter the Rule Name.
In the If requests match... section, select if you wish to apply the rule to all incoming requests or only to requests that match a custom filter expression and click Configure in the Origin SNI section. Then, enter an SNI based on your business requirements.
Click OK.