Dest & SNI

[Havard20009]

hello
can anyone explain to me how reality work with dest and sni ?
i mean my vps is in Germany should i used any dest or sni in Germany ?
or i should use any dest or sni from my country websites ?
which one is more important dest or sni ?
if there is a source about it plz give it to me.
thank you.

[chika0801]

For example, your country is France, your VPS is Germany, dest parameters there, fill in the site, this site is recommended not to use the French.

This site can be German, or the closer to the city where your VPS is located, the better. Or this site has a CDN service.

SNI (service name) recommended, for example, you use Chrome to open the site, press F12, check the security, click on the left side of the primary source there.

Topics github.com
SAN	
github.com
www.github.com

Fill in the domain name that is included in the certificate for this site.

[thenorthatlantic]

Which domain should have TLS 1.3 H2, Dest or SNI? For instance, is it possible to employ an HTTP destination while utilizing a TLS 1.3 H2 domain as the SNI?

[chika0801]

Dest

Which domain should have TLS 1.3 H2, Dest or SNI? For instance, is it possible to employ an HTTP destination while utilizing a TLS 1.3 H2 domain as the SNI?

dest parameter here, you have to fill in the domain name, the domain name of the TLS certificate to be 1.3 version, the site should support H2

The service name parameter fills in which domain names are included in the TLS certificate of this website.

[iamtheted]

Hello there,

I have set "Dest" an IP and It has been working fine but what I have done is not the same thing as you have stated as reality standards, so I wonder how It is working for me.

I am a little confused, can we set "Dest" an IP of the SNI or not?

Please clarify on this if It's possible for you
I really appreciate it!

[chika0801]

dest This parameter can be filled with an IP address. For example, try the IP address 1.1.1.1 (IP certificate related content). At this point, you will server-side

                "serverNames": [
                    ""
                ], .

parameter on the server side.

Then your client-side serverNames parameter, you can either leave it blank or fill in any one of the URLs. This is a hidden play, the author mentioned it on Xray's tg channel. But the author doesn't recommend to use it widely, because it has some features.

If you fill in a domain name at dest, the domain name is www.abc.com for example, and you ping this domain name on VPS to get an IP, I heard others say that if you fill in this IP at dest, and then fill in the corresponding SNI at serverNames, you can also connect successfully. Only this method, I did not use.

[iamtheted]

Okay so we can set an IP in "Dest" as long as that IP belongs to the SNI we have set, am I right?
And my question is that is this risky? Setting "Dest" an IP? It does work but my concern is whether the GFW can detect this or not.

Also thank you for the trick with 1.1.1.1, I really appreciate It.

[chika0801]

Where to find such IPs (with IP certificates like 1.1.1.1) I don't know a good way.

This method can work for ages in your area and end up being blocked with no one testing the report.

When the author mentioned this method on the Xray channel, he also just said that he doesn't recommend having a signature. You can use it, you know the risks that is. The strength of firewalls in everyone's area is different, and I don't know what's going on in your area.

[us254]

Dest

Which domain should have TLS 1.3 H2, Dest or SNI? For instance, is it possible to employ an HTTP destination while utilizing a TLS 1.3 H2 domain as the SNI?

dest parameter here, you have to fill in the domain name, the domain name of the TLS certificate to be 1.3 version, the site should support H2

The service name parameter fills in which domain names are included in the TLS certificate of this website.

#2077 (comment)

Can it be said that in a reality configuration, the servername parameter corresponds to the SANs listed in the SSL certificate for the Dest website?

For example, if the 'Dest' website is set to yahoo.com, would servername be a list of SANs associated with the yahoo.com domain as listed in its SSL certificate?

The SANs (servername) listed for the yahoo.com (Dest) domain are:

• tw.rd.yahoo.com
• s.yimg.com
• mbp.yimg.com
• hk.rd.yahoo.com
• fr-ca.rogers.yahoo.com
• ddl.fp.yahoo.com
• ca.rogers.yahoo.com
• ca.my.yahoo.com
• brb.yahoo.net
• add.my.yahoo.com

RPRX commented on May 15:

dest 填一个实际存在的网站，serverNames 基本上填什么都行，即使 dest 没有该域名，已经说过很多次了，请自行搜索

[chika0801]

Can it be said that in a reality configuration, the servername parameter corresponds to the SANs listed in the SSL certificate for the Dest website?

For example, if the 'Dest' website is set to yahoo.com, would servername be a list of SANs associated with the yahoo.com domain as listed in its SSL certificate?

That's how I see it. And I've always done it alone. That's how I answer when people ask me.

dest 填一个实际存在的网站，serverNames 基本上填什么都行，即使 dest 没有该域名，已经说过很多次了，请自行搜索

You can verify this method yourself. My test results for some sites like website is yahoo.com . I put it in the dert. Then I put in a random servername such as 123.com. It is possible that the client can connect to the server.

I guess it could be that this website yahoo.com has a one line IP universal certificate. But the situation I tested is not all websites can use this method. For example, you use some personal website. So I've been sticking to the filling method mentioned earlier.