Apache 2.4.46 & ELB

Question

Hi,
With the release of Apache 2.4.64 our website is broken, getting either a 403 or 421 error and the site is complaining that "the client needs a new connection for this request as the requested host name does not match the server name indication (SNI)"

We use an AWS ELB which appears to be where the issue stems from as documentation states AWS ELBs do not forward SNIs.
I have added "SSLStrictSNIVHostCheck off" to all our virtual hosts but still getting this error.

For the mean time I have reverted our Apache to 2.4.62.  Other hosts seem to be releasing their own fixes for this issue, is Amazon doing the same for the ELBs?  Or is there some other fix I can implement for this?  I do see mention of disabling http/2 but I can't find this option in the ELB settings.  Is there any official documentation from Amazon on this matter?

re:Post Agent · Answer

The issue you're experiencing with Apache 2.4.64 and your AWS Elastic Load Balancer (ELB) is a known problem that has affected many users after upgrading to this Apache version. The error occurs because Apache 2.4.64 introduced stricter Server Name Indication (SNI) checking, which conflicts with how AWS ELBs handle SSL/TLS connections.

While you've already implemented one part of the solution by adding "SSLStrictSNIVHostCheck off" to your virtual hosts, there are additional steps you can take to resolve this issue:

1. Ensure consistent SSL settings across all virtual hosts, including using the same SSL certificate and cipher suite configurations for every virtual host, especially your default one.

2. Add these headers to your Apache configuration to ensure proper protocol information is passed from the ELB to Apache:
```
RequestHeader set X-Forwarded-Proto "https"
RequestHeader set X-Forwarded-Port "443"
```

3. Make sure the following Apache modules are enabled:
- mod_ssl
- mod_headers

4. Consider updating your SSL protocol configuration:
```
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
SSLOptions +StdEnvVars
```

Regarding HTTP/2, while disabling it in the ELB might help, this setting isn't directly exposed in the ELB console. Your current approach of downgrading to Apache 2.4.62 is a valid temporary solution while you implement the above changes.

AWS hasn't released specific documentation addressing this particular Apache 2.4.64 issue with ELBs yet. However, the community has identified these workarounds that have successfully resolved the problem for many users. If these solutions don't work, continuing with Apache 2.4.62 remains a viable option until either AWS provides official guidance or a future Apache update addresses the compatibility issue.  
**Sources**  
[Misdirected Request The client needs a new connection for this request as the requested host name does not match the Server Name Indication (SNI) in use for this connection. Apache/2.4.52 | AWS re:Post](https://repost.aws/questions/QUo5zj15ydRQS0yRLU8JKd2w/misdirected-request-the-client-needs-a-new-connection-for-this-request-as-the-requested-host-name-does-not-match-the-server-name-indication-sni-in-use-for-this-connection-apache-2-4-52)

Apache 2.4.46 & ELB

Add your answer

Relevant content