PR#255: set SNI host name on SSL requests -

koji

#255 set SNI host name on SSL requests

Closed Jan 10, 2017 by mikem. Opened Dec 19, 2016 by mbrancaleoni.

mbrancaleoni/koji sni_support into master

mbrancaleoni commented Dec 19, 2016

in certain deployments with a shared server SNI is needed to point to the correct koji host, this should enable it.
Verified against an Apache+SNI using SSL certs authentication.

mikem commented Dec 19, 2016

How broadly have you tested this?

Are you running clients on very old systems? (If not, then you should be using the python-requests code path)

mbrancaleoni commented Dec 20, 2016

Well, I don't have hundreds of developers.

We've a small private koji instance used by 10~15 devs and the change has been pushed on all
FC23~25 users and on servers (koji, kojira, kojid) running on CentOS 7, so no very old system here.
(basically all are koji 1.10.1, from distro or epel packages)
All using ssl certs authentication.

I added the change into SSLCommon.py because by following the functions flow is the place where is needed to be added to add SNI support and no client is using the python-requests code.

Maybe makes sense to add SNI also to the "requests" path but not limited to it?

mbrancaleoni commented Dec 20, 2016

mmh with current python-requests SNI should work out of the box?

mikem commented Dec 20, 2016

I would suggest giving 1.11 a try first

mikem commented Jan 5, 2017

did 1.11 solve your issue?

mbrancaleoni commented Jan 10, 2017

sorry for the late answer.

Yes, on recent systems with 1.11 it works correcly.
So the fix I think is useful only on older distros without python-requests.

Not an issue for me, feel free to close the PR if not useful.

mikem commented Jan 10, 2017