{"id":333,"date":"2014-08-10T20:08:37","date_gmt":"2014-08-10T18:08:37","guid":{"rendered":"https:\/\/www.vioreliftode.com\/?p=333"},"modified":"2016-04-15T10:34:26","modified_gmt":"2016-04-15T08:34:26","slug":"microsoft-windows-webdav-client-does-not-support-server-name-indication-sni","status":"publish","type":"post","link":"https:\/\/www.vioreliftode.com\/index.php\/microsoft-windows-webdav-client-does-not-support-server-name-indication-sni\/","title":{"rendered":"Microsoft Windows WebDAV Client does not support Server Name Indication (SNI)"},"content":{"rendered":"

“\\\\syXXXXXXXXXXXXX.ro@SSL\\DavWWWRoot is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.\u00a0A device attached to the system is not functioning.”
\n\"\\\\syXXXXXXXXXXXXX.ro@SSL\\DavWWWRoot<\/a><\/em><\/p>\n

 <\/p>\n

Recently on one of my SharePoint farms I noticed the “Open with Explorer” is not working. After couple of minutes of digging into the settings and performing network traffic captures I realized is not the SharePoint farm fault. In fact is the Microsoft Windows WebDAV Client who’s not capable to handle the\u00a0Server Name Indication\u00a0(SNI)<\/span>.<\/p>\n

 <\/p>\n

From Wikipedia: “Server<\/a> Name Indication\u00a0(SNI)<\/a>\u00a0is an extension to the TLS protocol that indicates to what hostname the client is attempting to connect at the start of the handshaking process. This allows a server to present multiple certificates on the same IP address and port number and hence allows multiple secure (HTTPS) websites (or any other Service over TLS) to be served off the same IP address without requiring all those sites to use the same certificate. It is the conceptual equivalent to HTTP\/1.1 virtual hosting for HTTPS.”
\n<\/em><\/p>\n

 <\/p>\n

When you have only one IP address available, you host multiple domains,\u00a0multiple services and all of the communication traffic must be encrypted, then the only solution is to use Server Name Indication (SNI).<\/p>\n

 <\/p>\n

Let’s start with what IETF (Internet Engineering Task Force) RFCs are\u00a0saying about Server Name Indication:
\nRFC 3546 –\u00a0Transport Layer Security (TLS) Extensions<\/a>\u00a0(June 2003)
\nRFC\u00a04366 –\u00a0Transport Layer Security (TLS) Extensions<\/a> (April 2006)
\n<\/a>RFC\u00a06066 –\u00a0Transport Layer Security (TLS) Extensions: Extension Definitions<\/a>\u00a0(January 2011)
\n“TLS does not provide a mechanism for a client to tell a server the name of the server it is contacting. \u00a0It may be desirable for clients to provide this information to facilitate secure connections to servers that host multiple ‘virtual’ servers at a single underlying network address.
\n<\/span><\/em>…
\n<\/em>In order to provide any of the server names, clients MAY include an extension of type “server_name”<\/span> in the (extended) client hello. \u00a0The “extension_data” field of this extension SHALL contain “ServerNameList”<\/span>
\n<\/em>…
\n<\/em>A server that receives a client hello containing the “server_name” extension MAY use the information contained in the extension to guide its selection of an appropriate certificate to return to the client<\/span>, and\/or other aspects of security policy. In this event, the server SHALL include an extension of type “server_name” in the (extended) server hello. The “extension_data” field of this extension SHALL be empty.”<\/em><\/p>\n

 <\/p>\n

According with the latest update\u00a0(RFC\u00a06066 –\u00a0Transport Layer Security (TLS) Extensions: Extension Definitions<\/a>), the client has an important role – to include an extension of type “server_name”\u00a0that will help the server to identify the appropriate certificate that will be used to secure the connections. If the client doesn’t provide this\u00a0“server_name” extension, the server will not know what certificate to use and most likely will reply with a default one (which could be not issued for the FQDN the client is connecting to – case in which the communication channel should not be trusted).<\/p>\n

 <\/p>\n

SNI is not a recent extension. It was mentioned since June 2003 by the\u00a0RFC 3546 –\u00a0Transport Layer Security (TLS) Extensions<\/a>. However not all the clients (majority of them\u00a0web\u00a0browsers) are compliant with SNI. This is a\u00a0sad. Why does the software companies are not really taking serious these standards?<\/p>\n

 <\/p>\n

Microsoft Internet Explorer is SNI compliant starting with Microsoft Windows Vista and Internet Explorer 7.
\nI highlighted the key sections from the RFC, now let’s see how IE 11 and Microsoft Windows WebDAV behave with SNI. This will demystify the problem.<\/p>\n

 <\/p>\n

IE11 and IIS 8 (with\/without SNI)
\n<\/span><\/p>\n\n\n\n\n\n
Request & response between IE 11 and IIS 8 (without SNI)<\/th>\nRequest & response between IE 11 and IIS 8 (with SNI)<\/th>\n<\/tr>\n<\/thead>\n
\"IIS<\/a>
\n<\/a>\"The
\n<\/a>\"There<\/a>
\n<\/a><\/td>\n		\"IIS<\/a>
\n<\/a>\"The<\/a>
\n\"The<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

As we see, IE 11 always sends\u00a0extension “server_name” and IIS 8 responds with extension “server_name” only when is configured to use SNI.<\/p>\n

 <\/p>\n

 <\/p>\n

Microsoft Windows WebDAV Client and IIS 8 (with\/without SNI)<\/span><\/p>\n\n\n\n\n\n
Request & response between MS WebDAV and IIS 8 (without SNI)<\/th>\nRequest & response between MS WebDAV and IIS 8 (with SNI)<\/th>\n<\/tr>\n<\/thead>\n
\"IIS<\/a>
\n<\/a>\"SSL
\n<\/a>\"Because<\/a>
\n<\/a><\/td>\n		\"IIS
\n<\/a>\"SSL
\n<\/a>\"Because<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

In conclusion:<\/span><\/p>\n

    \n
  1. Microsoft Windows WebDAV Client does not support Server Name Indication (SNI).<\/li>\n
  2. If you troubleshoot\u00a0“Open with Explorer” from SharePoint, have look over the SNI configuration.<\/li>\n<\/ol>\n

     <\/p>\n

     <\/p>\n

    So far I found only one thread on the MSDN forums regarding\u00a0Microsoft Windows WebDAV Client and SNI compliance. Unfortunately the\u00a0moderator closed that thread due to lack of understanding.
    \n    http:\/\/social.technet.microsoft.com\/Forums\/windows\/en-US\/608765c8-0cc6-4e72-9255-9c436d2fd0e6\/sni-support-in-webdav-over-https<\/a><\/p>\n

     <\/p>\n

     <\/p>\n

    For those who would like to read\u00a0more about TLS:
    \n<\/em>    http:\/\/en.wikipedia.org\/wiki\/Transport_Layer_Security
    \n<\/a><\/em>    RFC\u00a02246 –\u00a0The TLS Protocol Version 1.0<\/a> (January 1999)
    \n<\/em>    RFC\u00a04346 –\u00a0The Transport Layer Security (TLS) Protocol Version 1.1<\/a> (April 2006)
    \n<\/em>    RFC\u00a05246 –\u00a0The Transport Layer Security (TLS) Protocol Version 1.2<\/a> (August 2008)<\/em><\/p>\n

     <\/p>\n","protected":false},"excerpt":{"rendered":"

    “\\\\syXXXXXXXXXXXXX.ro@SSL\\DavWWWRoot is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.\u00a0A device attached to the system is not functioning.”   Recently on one of my SharePoint farms I noticed the “Open with Explorer” is not working. After couple … Continue reading Microsoft Windows WebDAV Client does not support Server Name Indication (SNI)<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"Microsoft Windows WebDAV Client does not support Server Name Indication (SNI) http:\/\/wp.me\/p4NfDd-5n","jetpack_is_tweetstorm":false},"categories":[32,29],"tags":[48,94,49],"jetpack_featured_media_url":"","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4NfDd-5n","_links":{"self":[{"href":"https:\/\/www.vioreliftode.com\/index.php\/wp-json\/wp\/v2\/posts\/333"}],"collection":[{"href":"https:\/\/www.vioreliftode.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.vioreliftode.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.vioreliftode.com\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vioreliftode.com\/index.php\/wp-json\/wp\/v2\/comments?post=333"}],"version-history":[{"count":0,"href":"https:\/\/www.vioreliftode.com\/index.php\/wp-json\/wp\/v2\/posts\/333\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.vioreliftode.com\/index.php\/wp-json\/wp\/v2\/media?parent=333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.vioreliftode.com\/index.php\/wp-json\/wp\/v2\/categories?post=333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.vioreliftode.com\/index.php\/wp-json\/wp\/v2\/tags?post=333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}