SNI（服务器名称指示）适用于 TLS 1.2，但在 TLS 1.0 上被服务器拒绝

Question

这是 Wireshark 的输出：

1) TLS v1.0，服务器引发不支持的扩展 (110) 警报：

    TLSv1 Record Layer: Handshake Protocol: Client Hello
        Content Type: Handshake (22)
        Version: TLS 1.0 (0x0301)
        Length: 78
        Handshake Protocol: Client Hello
            Handshake Type: Client Hello (1)
            Length: 74
            Version: TLS 1.0 (0x0301)
            Random
            Session ID Length: 0
            Cipher Suites Length: 8
            Cipher Suites (4 suites)
                Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)
                Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
                Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
                Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)
            Compression Methods Length: 1
            Compression Methods (1 method)
                Compression Method: null (0)
            Extensions Length: 25
            Extension: server_name
                Type: server_name (0x0000)
                Length: 21
                Server Name Indication extension
                    Server Name list length: 19
                    Server Name Type: host_name (0)
                    Server Name length: 16
                    Server Name: www.google.co.uk

    TLSv1 Record Layer: Handshake Protocol: Server Hello
        Content Type: Handshake (22)
        Version: TLS 1.0 (0x0301)
        Length: 85
        Handshake Protocol: Server Hello
            Handshake Type: Server Hello (2)
            Length: 81
            Version: TLS 1.0 (0x0301)
            Random
            Session ID Length: 32
            Session ID: 56b1b6faae75e76baecb8a5727480a2b7687315baaeceb06...
            Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
            Compression Method: null (0)
            Extensions Length: 9
            Extension: renegotiation_info
                Type: renegotiation_info (0xff01)
                Length: 1
                Renegotiation Info extension
            Extension: server_name
                Type: server_name (0x0000)
                Length: 0

    TLSv1 Record Layer: Handshake Protocol: Server Hello Done
        Content Type: Handshake (22)
        Version: TLS 1.0 (0x0301)
        Length: 4
        Handshake Protocol: Server Hello Done
            Handshake Type: Server Hello Done (14)
            Length: 0

TLSv1 Record Layer: Alert (Level: Fatal, Description: Unsupported Extension)
    Content Type: Alert (21)
    Version: TLS 1.0 (0x0301)
    Length: 2
    Alert Message
        Level: Fatal (2)
        Description: Unsupported Extension (110)

2) TLS v1.2 工作正常，符合预期：

TLSv1.2 Record Layer: Handshake Protocol: Client Hello
    Content Type: Handshake (22)
    Version: TLS 1.2 (0x0303)
    Length: 78
    Handshake Protocol: Client Hello
        Handshake Type: Client Hello (1)
        Length: 74
        Version: TLS 1.2 (0x0303)
        Random
        Session ID Length: 0
        Cipher Suites Length: 8
        Cipher Suites (4 suites)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA (0x0039)
            Cipher Suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA (0x0033)
            Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
            Cipher Suite: TLS_EMPTY_RENEGOTIATION_INFO_SCSV (0x00ff)
        Compression Methods Length: 1
        Compression Methods (1 method)
            Compression Method: null (0)
        Extensions Length: 25
        Extension: server_name
            Type: server_name (0x0000)
            Length: 21
            Server Name Indication extension
                Server Name list length: 19
                Server Name Type: host_name (0)
                Server Name length: 16
                Server Name: www.google.co.uk

TLSv1.2 Record Layer: Handshake Protocol: Server Hello
    Content Type: Handshake (22)
    Version: TLS 1.2 (0x0303)
    Length: 85
    Handshake Protocol: Server Hello
        Handshake Type: Server Hello (2)
        Length: 81
        Version: TLS 1.2 (0x0303)
        Random
        Session ID Length: 32
        Session ID: c702788e7eaea1da30876968caedd785819c304da7e08bde...
        Cipher Suite: TLS_RSA_WITH_AES_128_CBC_SHA (0x002f)
        Compression Method: null (0)
        Extensions Length: 9
        Extension: renegotiation_info
            Type: renegotiation_info (0xff01)
            Length: 1
            Renegotiation Info extension
        Extension: server_name
            Type: server_name (0x0000)
            Length: 0

TLSv1.2 Record Layer: Handshake Protocol: Server Hello Done
    Content Type: Handshake (22)
    Version: TLS 1.2 (0x0303)
    Length: 4
    Handshake Protocol: Server Hello Done
        Handshake Type: Server Hello Done (14)
        Length: 0

TLSv1.2 Record Layer: Handshake Protocol: Client Key Exchange
    Content Type: Handshake (22)
    Version: TLS 1.2 (0x0303)
    Length: 262
    Handshake Protocol: Client Key Exchange
        Handshake Type: Client Key Exchange (16)
        Length: 258
        RSA Encrypted PreMaster Secret

然后它继续成功完成握手。

我知道 SNI 的引入晚于 TLS v.1.0 RFC，但据我了解，它不应该阻止 SNI 在 v1.0 上工作？

[在任何人建议只更新到 TLS v1.2 之前 - 很乐意这样做，但在旧客户端 atm 上受到 space/memory 的限制。作为参考，这是 Windows CE 上的 .NET compact Framework 客户端运行。]

Answer 1

原来是 [旧] BouncyCastle C# 端口中的错误，已在最新的 BC 版本中修复。感谢 Steffen Ullrich

SNI（服务器名称指示）适用于 TLS 1.2，但在 TLS 1.0 上被服务器拒绝

SNI (server name indication) works with TLS 1.2, but rejected by server on TLS 1.0

ssl

tls1.2