Feature Overview

If muliple domain names are sharing the same IP address on origin server and when CDN forwards requests to the origin server over HTTPS, you can configure the origin SNI feature to indicate the service domain name of origin requests, so the origin server can return the correct SSL certificate of the specified domain name.

How Origin SNI Works

Server Name Indication (SNI) is an extension of the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols to support multiple certificates and domain names on the same origin server. SNI allows a server to support multiple certificates on the same IP address and TCP port, which enables multiple HTTPS websites to use the same origin IP address and port. After the origin SNI feature is enabled, when an origin server receives a TLS handshake request from CDN, it determines the requested domain name based on the SNI information included in the TLS handshake request. Then, the origin server returns the correct SSL certificate to the CDN.

Origin SNI works based on the following process:

When a CDN POP redirects a request to the origin server over HTTPS, the domain name for which the request is destined is specified by SNI.
After the origin server receives the request, it responds with the SSL certificate of the requested domain name based on SNI.
After receiving the SSL certificate, the CDN POP establishes a secure connection to the origin server.

Procedure

eSurfing Cloud CDN allows you to configure different SNI values for different origin servers. If more than one origin server is configured for a domain name, you can configure one or multiple SNI values for these origin servers. Currently, this feature cannot be configured on your own. If you need to enable this feature, please contact our customer support team via hotline (852)31000000 or email global.noc@chinatelecomglobal.com. This feature can only be manually configured by the technical support team.

Content Delivery Network

Origin request with SNI