On Thu, Feb 24, 2005 at 09:59:03AM -0600, Aleksandar Milivojevic wrote: > -> GET / HTTP/1.0 > -> Host: www.foobar.com > -> More-Headers: blah blah > -> > <- HTTP/1.0 200 OK > <- More-Headers: more blah blah > <- > <- content of index.html from foobar.com > > However, HTTPS does not provide for this option. There is no standard > describing anything like this for HTTP protocol. And it is not likely > that there will be one in foreseable future. If there was, server would > be able to choose correct certificate before SSL handshake was to occur > based on data passed from the client (the host header). Actually, there is such a standard, RFC 2817, but since it's not compatible with HTTP/1.1, it's unlikely to be deployed widely. (it's kind of supported by mod_ssl in the Apache httpd 2.1.x series) There's also an extension to the TLS protocol itself which allows the client to specify the server hostname in the TLS handshake itself, but again, this poses backwards-compat issues so uptake is likely to be slow. (it's not implemented in OpenSSL either) joe
