Implicit SSL certificate management without server name indication (SNI)
Embodiments disclose a reverse lookup using an IP:Port-to-hostname table to identify a hostname when only an IP address and port is present in an SSL hello connection, which may occur, for example, when a non-SNI-capable client initiates the SSL hello. Once the hostname is successfully looked up, a naming convention is used to simplify the management and identification of SSL certificates. Different types of SSL certificates are supported. Multiple hostname matches may be associated with a given IP address and port in the IP:Port-to-hostname table. In such case, the first-matching hostname is always used with the naming convention to identify related SSL certificates. The naming convention is applied in such a way that it will first look for the most matching file name to the least matching file name.
1. A method performed by a web server, comprising:
receiving an SSL Hello message from a client;
determining that the SSL Hello message does not include a hostname;
identifying one or more corresponding hostnames from an IP:Port-to-hostname mapping using an IP address and port associated with the SSL Hello message;
modifying a selected corresponding hostname to create an SSL certificate search name; and
searching an SSL certificate store using the SSL certificate search name.
2. The method of claim 1 , further comprising:
identifying an SSL certificate in the SSL certificate store that corresponds to the SSL certificate search name; and
sending the SSL certificate to the client.
3. The method of claim 1 , wherein the selected corresponding hostname is a first-listed hostname of the one or more corresponding hostnames from the IP:Port-to-hostname mapping.
4. The method of claim 1 , further comprising:
modifying the selected corresponding hostname using a naming convention by adding a file-name extension to the selected corresponding hostname to create the SSL certificate search name.
5. The method of claim 4 , wherein the file-name extension is .pfx.
6. The method of claim 1 , further comprising:
determining that no SSL certificates in the SSL certificate store correspond to the SSL certificate search name;
modifying the SSL certificate search name to create a modified SSL certificate search name; and
using the modified SSL certificate search name to search the SSL certificate store.
7. The method of claim 6 , further comprising:
modifying the SSL certificate search name using a naming convention by replacing a sub-domain in the SSL certificate search name with a wildcard character.
8. The method of claim 7 , wherein the wildcard character is an underscore character.
9. The method of claim 1 , wherein the IP:Port-to-hostname mapping comprises entries that associate an IP:Port to multiple hostnames.
10. The method of claim 1 , wherein the IP:Port-to-hostname mapping comprises one or more entries that associate an IP address paired with a port number to a hostname.
11. The method of claim 4 , further comprising:
identifying an SSL certificate associated with the web server;
identifying one or more hostnames listed in the SSL certificate; and
for each of the one or more listed hostnames, saving the associated SSL certificate to the SSL certificate store using a file name comprising the file-name extension appended to the listed hostname.
12. The method of claim 4 , further comprising:
identifying a wildcard SSL certificate associated with the web server;
identifying a top domain name listed in the SSL certificate; and
saving the associated SSL certificate to the SSL certificate store using a file name comprising a wildcard character prepended to the top domain name and the file-name extension appended to the listed hostname.
13. A computer system, comprising:
one or more processors;
system memory;
one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by the one or more processors, causes the processors to perform a method for identifying SSL certificates, the processor operating to:
receive an SSL Hello message from a client;
identify one or more corresponding hostnames from an IP:Port-to-hostname mapping using an IP address and port associated with the SSL Hello message;
modify a selected corresponding hostname to create an SSL certificate search name; and
search an SSL certificate store using the SSL certificate search name.
14. The computer system of claim 13 , the processor further operating to:
identify an SSL certificate in the SSL certificate store that corresponds to the SSL certificate search name; and
send the SSL certificate to the client.
15. The computer system of claim 13 , the processor further operating to:
modify the selected corresponding hostname using a naming convention by adding a file-name extension to the selected corresponding hostname to create the SSL certificate search name.
16. The computer system of claim 13 , the processor further operating to:
determine that no SSL certificates in the SSL certificate store correspond to the SSL certificate search name;
modify the SSL certificate search name to create a modified SSL certificate search name; and
search the SSL certificate store using the modified SSL certificate search name.
17. The computer system of claim 13 , the processor further operating to:
identify an SSL certificate associated with the web server;
identify one or more hostnames listed in the SSL certificate; and
for each of the one or more listed hostnames, saving the associated SSL certificate to the SSL certificate store using a file name comprising the file-name extension appended to the listed hostname.
18. The computer system of claim 16 , the processor further operating to:
identify a wildcard SSL certificate associated with the web server;
identify a top domain name listed in the SSL certificate; and
saving the associated SSL certificate to the SSL certificate store using a file name comprising a wildcard character prepended to the top domain name and the file-name extension appended to the listed hostname.
19. A computer program product for implementing a method for identifying SSL certificates on a web server, the computer program product comprising one or more computer-readable storage media having stored thereon computer-executable instructions that, when executed by one or more processors of a computing system, cause the computing system to perform the method comprising of:
receive an SSL Hello message from a client;
identify one or more corresponding hostnames from an IP:Port-to-hostname mapping using an IP address and port associated with the SSL Hello message;
modify a selected corresponding hostname by adding a file-name extension to create an SSL certificate search name; and
search an SSL certificate store using the SSL certificate search name.
20. The computer program product of claim 19 , further comprising:
determine that no SSL certificates in the SSL certificate store correspond to the SSL certificate search name;
modify the SSL certificate search name to create a modified SSL certificate search name; and
search the SSL certificate store using the modified SSL certificate search name.