webmin/webmin — pull request #55 by mnoorenberghe (2013-05-26 08:59:39+00:00)
Title: Use Server Name Indication (SNI) for SSL certificate monitoring

SSL Certificate monitoring would consistently fail for me on a HTTPS site using a shared IP address because s_client wasn't using Server Name Indication (SNI) and therefore the certificate for the default site was being checked. The failure was because I had "detect hostname mismatch" turned on which is good otherwise I wouldn't have known it was checking the wrong cert. This servername option has been supported in openssl for many years (despite the option not being listed on the man page) so I suspect it's fine to rely on this argument. I'm not sure if there is a case where supplying the servername argument would be undesirable.