SSL_USE_SNI Environment Variable

Enables the client to use Server Name Indication (SNI) in the TLS handshake to identify the server name that it is trying to connect to.

Client: Optional
Server: Optional
Valid in: SAS invocation, configuration file
Categories: Communications: Networking and Encryption
System Administration: Security
Default: By default, the TLS SNI extension is not sent as part of the TLS handshake.
Restrictions: The SSL_USE_SNI environment variable is supported only on UNIX.
Windows always sends SNI to the web servers. Some web servers do not support SNI and fail to connect when the TLS SNI extension is present.
Operating environment: UNIX
Note: When this environment variable is specified, the TLS SNI extension is sent to the web server.
See: Defining Environment Variables in UNIX Environments in SAS Companion for UNIX Environments
Examples: Export the environment variable on UNIX hosts for the Bourne Shell :
export SSL_USE_SNI=1
Set the environment variable on UNIX hosts for the C Shell :
SETENV SSL_USE_SNI 
Set the environment variable at SAS invocation for UNIX hosts:
sas -dms -set SSL_USE_SNI

Syntax

SSL_USE_SNI

Syntax Description

SSL_USE_SNI

UNIX clients and servers now support TLS Server Name Indication (SNI). The client uses SNI in the first message of the TLS handshake (connection setup) to identify the server name that it is trying to connect to.

Default SNI is disabled by default on UNIX. To enable SNI, specify the SSL_USE_SNI environment variable.

Details

The client uses SNI in the TLS handshake to identify the server name that it is trying to connect to. When making a TLS connection, the client requests a digital certificate from the web server. After the server sends the certificate, the client examines it and compares the name that it was trying to connect to with the name or names included in the certificate. If a match is found, the connection proceeds as normal.
Note: When SSL_USE_SNI is set, some server connections might fail. For example, PROC IOMOPERATE using an Apache proxy (HTTP CONNECT) might not connect when the SSL_USE_SNI environment variable is set. In that case, disable the environment variable.

See Also

For more information, see Troubleshooting TLS.