@@ -368,17 +368,17 @@ IP/Port) must share the same SSL configuration, especially the same SSL
368368certificate. Only the HTTP Host header will be considered to find the right
369369virtual server.
370370
371- When enabled, SSL configuration can be different from a virtual server to
372- another, each one can have its own SSL certificate. In this case, if a client
371+ When enabled, SSL configuration can be different from one virtual server to
372+ another; each one can have its own SSL certificate. In this case, if a client
373373provides a SNI hostname, it will be used to find the right virtual server. To
374- accept the SNI information from the client, The first virtual server ( the
375- default one, see \fB pick_first_virthost_on_nomatch \fR ) \fB must \fR include TLS as
374+ accept the SNI information from the client, the first virtual server -- the
375+ default one, see \fB pick_first_virthost_on_nomatch \fR -- \fB must \fR include TLS as
376376a permitted protocol.
377377
378378If \fB sni \fR directive is set to \fI enable \fR , non SNI clients are allowed. For
379379such clients, virtual servers are selected as if Yaws did not have SNI
380- support. If it is set to \fI strict \fR , SNI hostname is mandatary to access a SSL
381- virtual server. But, in all cases, when SNI support is enabled, if a client
380+ support. If it is set to \fI strict \fR , SNI hostname is mandatory to access a SSL
381+ virtual server. But in all cases, when SNI support is enabled, if a client
382382provides a SNI hostname, it \fB must \fR match the HTTP Host header (which is
383383mandatory too). Note that the first virtual server (the default one) will be
384384used for any request where the provided SNI hostname doesn't match any of
@@ -387,8 +387,8 @@ most restrictive access control, otherwise clients can access restricted
387387resources by sending a request for any unknown hostname. (This isn't actually
388388any different from using virtual servers without SNI support.)
389389
390- The \fB sni \fR directive is a global one, so if you set it to \fI strict \fR , non
391- SNI clients will be refused for \fB all \fR SSL groups. See \fB require_sni \fR
390+ The \fB sni \fR directive is a global one, so if you set it to \fI strict \fR ,
391+ non- SNI clients will be refused for \fB all \fR SSL groups. See \fB require_sni \fR
392392directive from the server part to mitigate this requirement.
393393
394394Default is \fI disable \fR .
0 commit comments