Skip to content

Commit 7b8e7ac

Browse files
authored
Link between BYOIP and SSL for non-SNI (#18801)
* Mention BYOIP in non-SNI support * Also update BYOIP page * Fix format
1 parent 9507e4d commit 7b8e7ac

File tree

2 files changed

+9
-3
lines changed

2 files changed

+9
-3
lines changed

src/content/docs/byoip/troubleshooting.mdx

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,4 +22,10 @@ If you are experiencing packet loss as a result of an upstream ISP implementing
2222

2323
## Non-SNI support
2424

25+
:::caution
26+
2527
Currently, BYOIP cannot be used with [legacy custom certificates](/ssl/edge-certificates/custom-certificates/uploading/) to support <GlossaryTooltip term="Server Name Indication (SNI)" link="/ssl/reference/browser-compatibility/#non-sni-support">non-SNI</GlossaryTooltip> requests.
28+
29+
:::
30+
31+
An Address map can set the default SNI to enable non-SNI support, the default SNI can be any valid zone or subdomain owned by the account holding the BYOIP prefix. Refer to [Update Address Map API](/api/resources/addressing/subresources/address_maps/methods/edit/) for more information.

src/content/docs/ssl/reference/browser-compatibility.mdx

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,14 +25,14 @@ Refer to [Certificate authorities](/ssl/reference/certificate-authorities/) for
2525

2626
## Non-SNI support
2727

28-
Although [SNI extensions](https://www.cloudflare.com/learning/ssl/what-is-sni/) to the TLS protocol were standardized in 2003, some browsers and operating systems only implemented this extension when TLS 1.1 was released in 2006 (or 2011 for mobile browsers).
29-
30-
If your visitors use devices that have not been updated since 2011, they may not have SNI support.
28+
Although [SNI extensions](https://www.cloudflare.com/learning/ssl/what-is-sni/) to the TLS protocol were standardized in 2003, some browsers and operating systems only implemented this extension when TLS 1.1 was released in 2006 (or 2011 for mobile browsers). If your visitors use devices that have not been updated since 2011, they may not have SNI support.
3129

3230
To support non-SNI requests, you can:
3331

3432
* [Upload a custom certificate](/ssl/edge-certificates/custom-certificates/uploading/#upload-a-custom-certificate) and specify a value of `Legacy` for its client support.
3533

3634
Note that `Legacy` custom certificates are not compatible with [BYOIP](/byoip/) and that, unlike [Universal SSL](/ssl/edge-certificates/universal-ssl/) or [advanced certificates](/ssl/edge-certificates/advanced-certificate-manager/), Cloudflare does not manage issuance and renewal for [custom certificates](/ssl/edge-certificates/custom-certificates/).
3735

36+
* (BYOIP customers only) Enterprise customers can choose to bring your own IP prefix to Cloudflare Network and [specify the default SNI used for any handshake in the address map](/byoip/troubleshooting/#non-sni-support).
37+
3838
* (Paid plans only) [Contact Cloudflare Support](/support/contacting-cloudflare-support/) and request a set of dedicated IPs for your zone.

0 commit comments

Comments
 (0)