How to manually connect to my web server and send a TLS handshake with a hostname, followed by the HTTP request headers with a different hostname

Question

My Apache web server logs suffer from the dreaded error:

[ssl:error] AH02032: Hostname www.example.com provided via SNI and
 hostname example.com provided via HTTP are different

I know what it means and why it happens.

I need to manually reproduce the error in my logs. So that is what I'm asking.

How can I do it?

To be slightly more specific, I need to see if my web server upgrade still logs these incidents, and if so, take action to filter them from my log file.

This much I know: I need to send a hostname in the TLS handshake, e.g. www.example.com, to my web server (SNI should be handled automatically by the web server). Then send a different hostname, e.g. example.com, in the HTTP header.

I'm comfortable with telnet / openssl, etc., but don't know where to begin figuring out the commands.

First attempt at doing this:

I'm getting close, but for some reason the error is different and only appears the first time:

$ openssl s_client -crlf -connect www.example.com:443

> GET / HTTP/1.1
> Host: example.com
> [ENTER]

[Sat Mar 05 17:31:35.958118 2022] [ssl:error] [pid 512:tid 139776568080128]
[client 10.0.0.100:37982] AH02032: Hostname www.example.com provided via SNI
and hostname example provided via HTTP have no compatible SSL setup

Notice the second hostname is example, even though I typed in example.com

Second attempt at doing this:

$ openssl s_client -crlf -connect www.example.com:443

> GET / HTTP/1.1
> Host: example.com
> [ENTER]

Nothing reported in the log file, neither on the old server or new. I'm sending a different SNI hostname (I think) than HTTP hostname, so maybe the openssl client autocorrected, which is what I'd expect?

Answer 1

The servername flag was the difference.

$ openssl s_client -crlf -connect example.com:443 -servername www.example.com

GET / HTTP/1.1
Host: example.com
[ENTER]

Apache 2.4.6:

[Sat Mar 05 18:13:23.217568 2022] [ssl:error] [pid 22316] AH02032: Hostname
 www.example.com provided via SNI and hostname example.com provided via HTTP
 are different

Apache 2.4.52 does not produce this error in the log file.

Also, man openssl-s_client was helpful.