Why this behavior exists
The stricter validation helps ensure that HTTPS requests are being sent to the intended server. By verifying that the HTTP `Host` header matches the hostname presented in the server's TLS certificate, IQ Server aligns with modern security defaults and helps detect configuration errors such as mismatched certificates, incorrect routing, or unexpected proxy behavior.
Most direct client connections are unaffected because the hostname used to establish the TLS connection, the certificate presented by the server, and the HTTP `Host` header all naturally match.
The issue is most commonly encountered in reverse proxy or load balancer deployments where those values have been intentionally decoupled (for example, a load balancer connecting to IQ Server by IP address while forwarding a different external `Host` header).
Description
After upgrading to IQ Server v205, some customers using a load balancer or reverse proxy may receive:
400 Invalid SNI
This can occur when the hostname sent in the HTTP Host header does not match a hostname listed in the IQ Server TLS certificate.
A common example is a load balancer connecting to IQ Server by IP address while forwarding the original external Host header.
Resolution
Configure the load balancer Host header
Configure the load balancer to send a backend Host header that matches a DNS name in the IQ Server certificate.
Where supported, the load balancer should also send the same hostname as the TLS SNI server name.
For example:
Backend address: 192.0.2.10:8443
TLS SNI name: iq.internal.example.com
Host header: iq.internal.example.com
Certificate SAN: iq.internal.example.com
The load balancer may continue connecting to IQ Server using the backend IP address.
Label: CLM-42858