Symptoms

SNI hostname submitted to a virtual server on the client side is sent to server side, even if there is a different hostname specified in the server SSL profile.

Impact

SNI is sent from client to server without stripping or rewriting the SNI.

Conditions

-- Client side ClientHello contains SNI.

Workaround

None.

Fix Information

SNI hostname submitted to a virtual server on the client side is no longer sent to server side unless specifically requested (for example when forward proxy is enabled). When there is a different hostname specified in the server SSL profile the SNI is also rewritten to the specified hostname.

Behavior Change