Apache SNI config to send handshake alert: unrecognized_name

itemprop="text">

I am trying to achieve what some years
ago was a problem due to miss configured servers that caused

"handshake alert:
unrecognized_name"

when a SNI
enabled client ( for Java 1.7 or bigger clients) would send during the handshake the

Extension server_name, server_name: [type=host_name (0),

value=hostname]

for
example this question was how to avoid this
:

href="https://stackoverflow.com/questions/7615645/ssl-handshake-alert-unrecognized-name-error-since-upgrade-to-java-1-7-0">https://stackoverflow.com/questions/7615645/ssl-handshake-alert-unrecognized-name-error-since-upgrade-to-java-1-7-0.

My
apache version is 2.4.33, on Ubuntu 16.04.

and the config file that
I use looks like this :

            ssl_module>
Listen
            8095


            mod_gnutls.c>
Listen
            8095



ServerName
            localhost


             _default_:8095>
 ServerName
            value.that.does.not.match.the.cn.in.certificate
 ServerAlias
            value.that.does.not.match.the.cn.in.certificate
 DocumentRoot
            /var/www/html

 SSLEngine on
 SSLCertificateFile
            /path_to_certificates/selfsigned.cert

 SSLCertificateKeyFile
            /path_to_certificates/selfsigned.key
 SSLVerifyClient none

            SSLVerifyDepth 10

            

I
have done some research and I used the following command to check that SNI is enabled
for the hostname that I expose through apache
:

openssl s_client -servername
            hostanametocheck -tlsextdebug -connect hostanametocheck:8095 2>/dev/null | grep
            "server
            name"

for
which the result is :

TLS server
            extension "server name" (id=0),
            len=0

which from what
I've read it is an indicator that apache sends this extension during the handshake which
in case of Java clients > 1.7 would end up as an exception during the
handshake.

I would expect that my Java client
(1.8) would receive that alert and the handshake will fail, but as I landed here it does
not. I already spend a quite good amount of time trying to figure out this but looks
like it is beyond my networking and linux knowledge.

Btw, I am running the apache on my
dev machine, therefore the 8095 port instead of 443. I mapped the hostname to
localhost.
SNI is enabled on the client side as I can see in the handshake
logs that the extension is sent

Extension server_name,
            server_name: [type=host_name (0),
            value=hostname.that.does.not.match.cn.in.certificate.com]

Your
help would be really appreciated!

class="post-text" itemprop="text">

class="normal">Answer

I had
successfully caused the error , with Apache 2.2.22 ( but some old version, unpatched )
as it looks like they started removing that alert from being sent starting with 2.4.1
and some versions back. More on the following
link.

href="https://bz.apache.org/bugzilla/show_bug.cgi?id=56241" rel="nofollow
noreferrer">https://bz.apache.org/bugzilla/show_bug.cgi?id=56241