288e4ca6da6169f1ab0fc77e897f869e0fa7d39c
galt
  Fri Dec 18 23:26:08 2015 -0800
Fixes #16554

diff --git src/lib/https.c src/lib/https.c
index 0d6112a..1a8f026 100644
--- src/lib/https.c
+++ src/lib/https.c
@@ -1,30 +1,31 @@
 /* Connect via https. */
 
 /* Copyright (C) 2012 The Regents of the University of California 
  * See README in this or parent directory for licensing information. */
 
 #ifdef USE_SSL
 
 #include "openssl/ssl.h"
 #include "openssl/err.h"
 
 #include <sys/socket.h>
 #include <unistd.h>
 #include <pthread.h>
 
 #include "common.h"
+#include "internet.h"
 #include "errAbort.h"
 #include "net.h"
 
 
 static pthread_mutex_t *mutexes = NULL;
  
 static unsigned long openssl_id_callback(void)
 {
 return ((unsigned long)pthread_self());
 }
  
 static void openssl_locking_callback(int mode, int n, const char * file, int line)
 {
 if (mode & CRYPTO_LOCK)
     pthread_mutex_lock(&mutexes[n]);
@@ -123,37 +124,50 @@
 
 // verify paths and mode.
 
 */
 
 
 sbio = BIO_new_ssl_connect(ctx);
 
 BIO_get_ssl(sbio, &ssl);
 if(!ssl) 
     {
     xerr("Can't locate SSL pointer");
     goto cleanup;
     }
 
+
+
 /* Don't want any retries since we are non-blocking bio now */
 //SSL_set_mode(ssl, SSL_MODE_AUTO_RETRY);
 
 
 safef(hostnameProto,sizeof(hostnameProto),"%s:%d",params->hostName,params->port);
 BIO_set_conn_hostname(sbio, hostnameProto);
 
+/* 
+Server Name Indication (SNI)
+Required to complete tls ssl negotiation for systems which house multiple domains. (SNI)
+This is common when serving HTTPS requests with a wildcard certificate (*.domain.tld).
+This line will allow the ssl connection to send the hostname at tls negotiation time.
+It tells the remote server which hostname the client is connecting to.
+The hostname must not be an IP address.
+*/ 
+if (!internetIsDottedQuad(params->hostName))
+    SSL_set_tlsext_host_name(ssl,params->hostName);
+
 BIO_set_nbio(sbio, 1);     /* non-blocking mode */
 
 while (1) 
     {
     if (BIO_do_connect(sbio) == 1) 
 	{
 	break;  /* Connected */
 	}
     if (! BIO_should_retry(sbio)) 
 	{
 	xerr("BIO_do_connect() failed");
 	char s[256];	
 	safef(s, sizeof s, "SSL error: %s", ERR_reason_error_string(ERR_get_error()));
 	xerr(s);
 	goto cleanup;