No default SSL Site has been Created?

When setting up a web server with SSL/TLS, it is important to have a default SSL site created. This is especially crucial if you want to support browsers that do not have Server Name Indication (SNI) capabilities.

SNI is an extension of the TLS protocol that allows a client to indicate the hostname it is attempting to connect to during the SSL handshake. This enables the server to present the appropriate SSL certificate for that hostname. However, not all browsers support SNI, particularly older versions.

By creating a default SSL site, you ensure that any incoming connections without a specific hostname will still be able to establish a secure connection. This is achieved by configuring the web server to use a default SSL certificate for such connections.

Here is an example of how to create a default SSL site using Apache HTTP Server:

Generate a self-signed SSL certificate:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout default.key -out default.crt

Configure the default SSL site in the Apache configuration file (httpd.conf or a separate virtual host file):


    ServerName default
    SSLEngine on
    SSLCertificateFile /path/to/default.crt
    SSLCertificateKeyFile /path/to/default.key

Restart the Apache server for the changes to take effect.
By following these steps, you will have a default SSL site that can handle connections from browsers without SNI capabilities. This ensures a secure browsing experience for all users accessing your website.

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Jignesh Kumar2y ago
Accepted answer
Hello Anadu,

Please try this one, if you are using IIS 8,

https://stackoverflow.com/questions/25412026/how-to-configure-a-default-web-site-for-https-using-sni-and-ccs

https://www.digicert.com/kb/ssl-support/iis8-sni-browser-support.htm
+4
Anandu G Nath2y ago
@Jignesh Kumar

I am hosting WCF Services on IIS .
I Already enabled SSl.

HTTP Is working now HTTPS not working.
+2
Jayraj Chhaya2y ago
When setting up a web server with SSL/TLS, it is important to have a default SSL site created. This is especially crucial if you want to support browsers that do not have Server Name Indication (SNI) capabilities.

SNI is an extension of the TLS protocol that allows a client to indicate the hostname it is attempting to connect to during the SSL handshake. This enables the server to present the appropriate SSL certificate for that hostname. However, not all browsers support SNI, particularly older versions.

By creating a default SSL site, you ensure that any incoming connections without a specific hostname will still be able to establish a secure connection. This is achieved by configuring the web server to use a default SSL certificate for such connections.

Here is an example of how to create a default SSL site using Apache HTTP Server:
1. Generate a self-signed SSL certificate:
2. openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout default.key -out default.crt
3. Configure the default SSL site in the Apache configuration file (httpd.conf or a separate virtual host file):
4. ServerName default SSLEngine on SSLCertificateFile /path/to/default.crt SSLCertificateKeyFile /path/to/default.key
5. Restart the Apache server for the changes to take effect.
6. By following these steps, you will have a default SSL site that can handle connections from browsers without SNI capabilities. This ensures a secure browsing experience for all users accessing your website.
+2