Network & Infrastructure / Segmentation, TLS & Secure Connectivity
TLS SNI routing and the correct certificate on the wrong backend
A shared HTTPS endpoint serves the wrong certificate or backend for one hostname. IP reachability and port checks pass because the failure depends on the requested server name.
Environment and inputs: Stateful network boundaries, TLS endpoints and IPsec gateways; use the deployed security policy and implementation manual. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Capture the client's intended hostname, SNI presence, selected virtual service and backend mapping. Test with the real hostname rather than an IP-only probe that changes the handshake context.
Explain the result
SNI allows a TLS endpoint to select configuration before application traffic. A default virtual host can appear healthy while the named service is misrouted or unsupported by a client.
Plan the fix
Correct hostname-to-service ownership and default behavior in the supported proxy configuration. Keep certificate selection and HTTP host routing consistent without assuming they are the same check.
Check the result and rollback
Validate every affected hostname with normal clients and an unknown-name negative case. Revert if the change redirects another tenant or exposes a default backend unexpectedly.