I did this
I ran "curl --insecure https://alice.sni.velox.ch./" on the command line
I expected the following
I expected cURL to send the following information:
SNI host name: alice.sni.velox.ch
HTTP Host header: alice.sni.velox.ch.
curl/libcurl version
7.38.0
[curl -V output perhaps?]
curl 7.38.0 (x86_64-pc-linux-gnu) libcurl/7.38.0 OpenSSL/1.0.1k zlib/1.2.8 libidn/1.29 libssh2/1.4.3 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API SPNEGO NTLM NTLM_WB SSL libz TLS-SRP
operating system
Debian 8
To quote a couple specifications:
https://tools.ietf.org/html/rfc6066#section-3 (SNI)
"HostName" contains the fully qualified DNS hostname of the server,
as understood by the client. The hostname is represented as a byte
string using ASCII encoding without a trailing dot.
https://tools.ietf.org/html/rfc7230#section-5.4 (HTTP)
A client MUST send a Host header field in all HTTP/1.1 request
messages. If the target URI includes an authority component, then a
client MUST send a field-value for Host that is identical to that
authority component, excluding any userinfo subcomponent and its "@"
delimiter (Section 2.7.1).
That means that the SNI host name and HTTP Host header do not always match. The SNI host name must never have a trailing dot, but the HTTP Host header must reflect a host name that is identical to the host name of the URI, so if the URI's host has a trailing dot, the HTTP Host header must include that trailing dot.
For example, if the URI of a page is https://alice.sni.velox.ch./, the following values should be sent by the Web browser:
SNI host: alice.sni.velox.ch
HTTP host: alice.sni.velox.ch.
However, while cURL properly strips the trailing dot off of the SNI host name as per RFC 6066, it also incorrectly strips the trailing dot off of the HTTP Host header.
I did this
I ran "curl --insecure https://alice.sni.velox.ch./" on the command line
I expected the following
I expected cURL to send the following information:
SNI host name: alice.sni.velox.ch
HTTP Host header: alice.sni.velox.ch.
curl/libcurl version
7.38.0
[curl -V output perhaps?]
curl 7.38.0 (x86_64-pc-linux-gnu) libcurl/7.38.0 OpenSSL/1.0.1k zlib/1.2.8 libidn/1.29 libssh2/1.4.3 librtmp/2.3
Protocols: dict file ftp ftps gopher http https imap imaps ldap ldaps pop3 pop3s rtmp rtsp scp sftp smtp smtps telnet tftp
Features: AsynchDNS IDN IPv6 Largefile GSS-API SPNEGO NTLM NTLM_WB SSL libz TLS-SRP
operating system
Debian 8
To quote a couple specifications:
https://tools.ietf.org/html/rfc6066#section-3 (SNI)
"HostName" contains the fully qualified DNS hostname of the server,
as understood by the client. The hostname is represented as a byte
string using ASCII encoding without a trailing dot.
https://tools.ietf.org/html/rfc7230#section-5.4 (HTTP)
A client MUST send a Host header field in all HTTP/1.1 request
messages. If the target URI includes an authority component, then a
client MUST send a field-value for Host that is identical to that
authority component, excluding any userinfo subcomponent and its "@"
delimiter (Section 2.7.1).
That means that the SNI host name and HTTP Host header do not always match. The SNI host name must never have a trailing dot, but the HTTP Host header must reflect a host name that is identical to the host name of the URI, so if the URI's host has a trailing dot, the HTTP Host header must include that trailing dot.
For example, if the URI of a page is https://alice.sni.velox.ch./, the following values should be sent by the Web browser:
SNI host: alice.sni.velox.ch
HTTP host: alice.sni.velox.ch.
However, while cURL properly strips the trailing dot off of the SNI host name as per RFC 6066, it also incorrectly strips the trailing dot off of the HTTP Host header.