Geek Answers Handbook

How to configure SNI support for Mojolicious?

Perl Mojolicious supports Server Name Identification (SNI) , which some web servers use to host multiple sites with a single HTTPS certificate. I am working on a system that is not configured for its use, and the search in different ways does not lead to what makes the process understandable and seemingly different parts. There are a few things mentioned in the StackOverflow Perl LWP GET or POST question on the SSL SNI URL.

So what do I need to do?

+6
source share
2 answers

Firstly, it is not Mojolicious (or LWP or anything else) that supports SNI. It is IO :: Socket :: SSL , but it’s actually not, because it is Net :: SSLeay , but in fact it is not your version of openssl .

  • Install openssl 1.0 or later. You probably want to use the --prefix option for configuration, to install it in a new directory, so as not to disturb what you already have and what other things depend on.
  • Update Net :: SSLeay to compile it against the new openssl. You need version 1.50 or later. The problem here is that the later Net :: SSLeay will work with older openssl . Updating the module will not give you a new openssl.
  • Update IO :: Socket :: SSL to 1.56 or later. The earliest release is from 2012, so you should still upgrade.
  • Mojolicious 2.83 (released in 2012, so old) added SNI support for clients, and Mojolicious 6.40 (a month ago) added it for all web servers.

You can find this information by looking at the changes file for each module, but for now, let’s get Net :: SSLeay sorted with it is not as simple as installing a module.

Some things you should pay attention to:

  • You need to compile perl, openssl and Net :: SSLeay with the same tools so that they are compatible with binary files.

Use the OPENSSL_PREFIX variable to tell cpan (and everything that it starts) where you can find the correct openssl .

  $ export OPENSSL_PREFIX=/usr/local/ssl $ cpan Net::SSLeay IO::Socket::SSL

If you already have the latest Net :: SSLeay , but compiled against the old version of openssl, you can force the module to recompile it even though cpan thinking about updating it:

  $ cpan -f Net::SSLeay IO::Socket::SSL

IO :: Socket :: SSL has methods for checking this (added in 1.84):

  $ /usr/local/ssl/bin/openssl version OpenSSL 1.0.1r 28 Jan 2016 $ perl -MIO::Socket::SSL -le 'print IO::Socket::SSL->VERSION' 2.024 $ perl -MIO::Socket::SSL -le 'print IO::Socket::SSL->can_client_sni' 1
+6
source

Not a direct answer to the question, but maybe the best solution.

From my experience as a shared hosting administrator for ~ 400 domains, it is more convenient to configure SSL in Apache, and Mojolicious runs under mod_perl2.

Including too much (network) configuration in an application is always a pain in the long run. In many cases, multi-domain applications can also become inconvenient.

Apache configuration allows you to manage standard scripts, for example. renew SSL certificates from letencrypt.

Of course, there may be good reasons and special requirements for other settings that are worth the extra work.

-1
source

More articles:


All Articles