Can TLSv1 / SNI be blocked by the network? (routers, firewalls, etc)

Cloudfront sets a header in replies like "X-Cache: Hit from cloudfront" in replies. Presumably, it will say "Miss" if your file wasn't in the cache of the node to which you were directed.

It is possible that your files just aren't popular enough, so they get ejected from CloudFront's cache by more popular content even though 24 hours haven't elapsed. Is also possible that IO overload or some other circumstance inside of a particular CloudFront node makes access slow. Cloudfront is very inexpensive compared with Akamai or LimeLight. Worst-case performance and guaranteed service levels are two of the reasons to use the more expensive players.

I would do a test, putting just one popular file into cloudfront in production, and then use periodic tests to see if CloudFront is indicating hits (also record total transaction time).

SNI is initiated by the client, so you need a client that supports it. Unless you're on windows XP, your browser will do. If your client lets you debug SSL connections properly (sadly, even the gnutls/openssl CLI commands don't), you can see whether the server sends back a server_name field in the extended hello. Note that the absence of this field only means that the server didn't use the server_name in the client hello to help pick a certificate, not that it doesn't support it.

So, in practice the easiest test is to simply try connecting. For this you need to know two names that resolve to the same IP, to which an ssl connection can be made. https is easiest as you can then simply browse to both names and see if you're presented with the correct certificate.

There are three outcomes:

• You get a wildcard certificate (or one with a subjectAltName) which covers both names: you learn nothing
• You get the wrong certificate for at least one of them: either the server does not support SNI or it has been configured wrong
• You get two different certificates, both for the correct name: SNI is supported and correctly configured.

A slightly more complicated test which will yield more info is to have wireshark open and capturing while browsing. You can then find the relevant packets by filtering for ssl.handshake. The screenshots below are an example of a client hello/server hello pair where SNI is supported:

Again, of course the absence of a server_name field in the server hello does not indicate that SNI is not supported. Merely that the client-provided server_name was not used in deciding which certificate to use.