Domino Web server support for Server Name Indication (SNI)

Domino 11.0.1 Web servers now support the Server Name Indication (SNI) extension to the Transport Security Layer (TLS) protocol.

SNI enables a Domino server to support multiple virtual host(s) (Web sites) over HTTPS where multiple host names can be configured to map to a single IP address. To enable SNI support, add the notes.ini setting ENABLE_SNI=1 to the server and restart the HTTP task.

Note the following things to consider before enabling SNI support:
  • To use SNI, there must be either a default Web site configured or at least one Web site with an IP address configured to use as the starting point for the TLS hand shake. If the server receives the TLS SNI extension, it attempts to switch to the site that matches the host name in the SNI extension after the TLS handshake is complete.
  • Enabling SNI may require you to adjust Web site configurations (rules and other settings). With SNI enabled, the server can map from the default or IP address Web site to another site by host name after the TLS handshake. This can cause a change in behavior in existing configurations where there may be one Web site with just an IP address configured and others with just the host name(s) configured. Old configurations would continue to use the IP address site. With SNI enabled, the request can switch to use a host name site which may have a different configuration than the IP address site.
  • On IBM i, SNI is supported natively on IBM i enabled for SSL Plus for HTTP and not for System SSL API.