title: nginx and IIS - dealing with invalid hostname and SSL
body: <p><strong>Setup</strong></p>
  
  <p>Client &lt;=(HTTPS)=> Nginx load balancer &lt;=(HTTPS)=> IIS 8</p>
  
  <p><em>(I know some people would ask why to use SSL between the nginx and the IIS, but this is not the topic of my question here.)</em></p>
  
  <p><strong>Error case</strong></p>
  
  <p>A spamming/scanning client connects with SSL with an invalid hostname, e.g. the hostname specified by the client contains a star (*). This makes the IIS close the connection during the handshake and Nginx then takes this as the IIS being down.</p>
  
  <p>When all IIS-servers are then down, the next request gets a "Bad gateway" from the nginx. This allows clients to falsely manipulate the nginx the think the IIS is down.</p>
  
  <p><strong>How to fix?</strong></p>
  
  <p>How would one fix this?</p>
  
  <ul>
  <li>Is it possible to deny requests in the nginx config with invalid
  hostnames based on looking at the characters?</li>
  <li>Or is it possible to make the IIS behave differently in these cases? The IIS already has a catch all ssl binding which just returns a 403 forbidden, but this is not hit in the explained case.</li>
  <li>Or do I have to list all allowed hostnames specifically in the nginx configuration?</li>
  </ul>