On this page
SNI, or Server Name Indication, lets one IP address present many SSL certificates. The client sends the hostname it wants during the TLS handshake, and the server picks the matching virtual host and cert. The default vhost is what answers when no name is sent, such as a raw IP visit or an older client. Keep that default plain so it never shows another customer’s site.
How SNI works on shared and dedicated servers
On shared hosting, cPanel serves the certificate that matches the name the browser sends. A dedicated server with many names on one address does the same thing. Modern browsers support SNI, so a dedicated IP is rarely required just for HTTPS. Dedicated IPs still exist for unusual clients, but you do not need them for ordinary sites.
- Confirm the name in the address bar matches the name on the certificate you installed.
- Test with curl using
--resolve, or with openssl using-servernameset to that hostname. That forces SNI on purpose. - Request the raw IP with no hostname. That response is the default vhost, and it should not be a customer storefront.
- If a mail client or scanner hits the IP alone, it will see the default certificate. Point those tools at the real hostname instead.
When a visitor thinks the site was hacked
Someone who opens the IP, or an old scanner without SNI, may see another account’s certificate name. That often leads to a ticket claiming a hack. In reality the client simply did not send a server name. Show them openssl without -servername and then with it. You will see two different certificate subjects, while the real site on the hostname remains fine.
Order of steps when you add a new name
Point DNS first, let AutoSSL issue the certificate, and only then send live traffic. If traffic arrives before the right certificate is ready, some clients cache a warning about the default cert. Once SNI is working correctly, you can force HTTPS in the application. Forcing HTTPS while the default vhost still answers for that name is how a phone can keep showing a lasting warning.
Tagged
Was this article helpful?
Be the first to rate this article.
