-
Notifications
You must be signed in to change notification settings - Fork 100
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SNI is not being sent #241
Comments
I too have the same issue - also using NextDNS. However in the readme of version 0.3.0.6 - it mentions openssl version: 1.1.1.b Can someone confim openssl version in use? We see in conblems wireshark that TLS1.2 is in use, if we were using openssl 1.1.1 - TLS 1.3 should be available and used? NOTE - NextDNS only supports use of openssl 1.1.1 or above |
Ok, I'll create a SNI switch for upstreams that need it. |
@wtoorop thanks where can we find it? I guess this would be a case for DoH where you can just pass parameters as URL Queryparts because ESNI would not work for DoT |
@conblem Sorry, haven't gotten to this yet, but I intend to implement it coming Friday |
@wtoorop woops my bad |
@conblem Hey, NP! It's nice too get a feel for the interest in a thing and also good to be remembered of something you |
@conblem @DanielSpindler83 I could not reproduce with the default build on my system. I see SNI being send with TLS1.3 but also with TLS1.2. This was with OpenSSL 1.1.1c. Could you do a |
Strangely I do have trouble with builds linked against GNUTLS. It appears authentication is always required, and also for NextDNS I need to restrict the maximum TLS version to 1.2. However, despite these settings, SNI was sent in all occasions. |
I have Stubby configured like this on Windows 10
When i inspect the TLS Client hello there is not SNI extension
Im using nextdns.io which needs the SNI Extension to identify devices.
The text was updated successfully, but these errors were encountered: