Invalid SNI message in BBj 24+

In BBj 24.00,  customers using the default BASIS self-signed SSL certificate may stumble across an Invalid SNI message when accessing web pages on their BBj Jetty using a secure HTTPS connection.

What does this mean?

SNI , or Server Name Indication, is an extension of the TLS protocol that allows a client, such as a web browser, to indicate which hostname it is attempting to connect to during the SSL handshake process. When an “Invalid SNI” error occurs, it signifies that the server received a request with a hostname that does not correspond to any listed in the SSL certificate.  If you are utilizing the default self-signed SSL certificate provided by BASIS during the installation of BBjServices, it is important to note that the hostname in the certificate will not match the hostname of your server.  Historically, this discrepancy did not pose significant issues. However, recent updates to the Jetty server have introduced stricter enforcement of SNI checking on HTTPS connections, unless additional measures are taken.

How to Resolve

To address the ‘Invalid SNI’ error, you have several options available. The most recommended approach is to obtain a valid SSL certificate for your server, ensuring that the SNI values match your domains. It’s important to recognize that the default self-signed certificate provided by BASIS serves as a placeholder and should be promptly replaced to bolster security. Alternatively, you can generate your own self-signed certificate that contains the correct domain name, however, it is worth noting this does not offer the same level of security as an official SSL certificate.

Finally , for those who are simply troubleshooting the issue, we have introduced a configuration option that reverts the Jetty server back to its original behavior. This can be done by setting the property “com.basis.server.jetty.SniHostCheck=false” in the BBj.properties file.