Re: Blocking unknown hostnames for SSL/TLS connections

2015-12-03 Thread Patrick O'Brien
On Thu, Dec 3, 2015 at 1:44 PM, Valentin V. Bartenev wrote: > On Thursday 03 December 2015 11:41:51 Patrick O'Brien wrote: >> Hello, >> >> We're currently using nginx for SSL/TLS termination, which then >> proxies the request to a pair of internal pai

Blocking unknown hostnames for SSL/TLS connections

2015-12-03 Thread Patrick O'Brien
Hello, We're currently using nginx for SSL/TLS termination, which then proxies the request to a pair of internal pair of load balancers. Since the TLS handshake is performed before nginx is able to figure out what hostname is being requested, except in cases where SNI is used, it will accept any r