From 13f9464d801916b08640c39f743002663ac86d79 Mon Sep 17 00:00:00 2001 From: ktroller Date: Tue, 1 Sep 2026 11:03:34 -0300 Subject: [PATCH] W-23941710: Document that CloudHub 2.0 rejects TLS connections without SNI when mTLS is enabled. --- cloudhub-2/modules/ROOT/pages/ps-config-domains.adoc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/cloudhub-2/modules/ROOT/pages/ps-config-domains.adoc b/cloudhub-2/modules/ROOT/pages/ps-config-domains.adoc index fb09040b..df82bde4 100644 --- a/cloudhub-2/modules/ROOT/pages/ps-config-domains.adoc +++ b/cloudhub-2/modules/ROOT/pages/ps-config-domains.adoc @@ -73,6 +73,11 @@ The optional truststore identifies trusted external clients or certificate autho To enable partial client authentication, configure a truststore. If a truststore is not configured, partial client authentication is disabled. +[IMPORTANT] +==== +When you configure a truststore for partial client authentication, clients must include a Server Name Indication (SNI) extension that matches the custom domain. Most TLS clients send SNI automatically when they connect by hostname. The CloudHub 2.0 ingress load balancer rejects TLS connections that don't include SNI, such as connections to the load balancer IP address. The TLS handshake fails with an `unrecognized name` alert. +==== + CloudHub 2.0 accepts truststore files in PEM formats. === DNS Targets