Bug report: MT5 build 6294 sends no SNI, so WebRequest fails

New comment
Build 6294: WebRequest() and TLS sockets fail on every HTTPS host that requires SNI (1009 / 5203, 5272)

Since build 6294, WebRequest() fails for every HTTPS host that requires SNI (Server Name Indication), while hosts that serve their certificate without SNI still work. The same EA and the same URLs work on build 6254.

Environment
- Build 6294 x64 (MetaQuotes Ltd. installation) on Linux (Wine 11.21): fails.
- The current build on a Windows Server 2022 VPS: fails the same way.
- Build 6254 on the same Windows VPS: works.
- Every URL below is on the allow-list (Tools > Options > Expert Advisors).

Results on build 6294 (script below)
- https://github.com/ (served without SNI): WebRequest = 200
- https://www.microsoft.com/ (served without SNI): WebRequest = 200
- https://www.google.com/ (requires SNI): WebRequest = 1009, GetLastError = 5203, no headers, about 190 ms
- A Supabase Edge Function behind Cloudflare (requires SNI): WebRequest = 1009, GetLastError = 5203, about 75 ms
- SocketConnect() to the same Supabase host on port 443: false, GetLastError = 5272

Why this points to a missing server name
- Cloudflare refuses a TLS hello without SNI with a handshake_failure alert (40). "openssl s_client -noservername" reproduces that against the same host at once, and the same handshake with SNI succeeds (TLS 1.3, P-256, ECDSA certificate).
- www.google.com answers a hello without SNI with a placeholder certificate ("No SNI provided - please fix your client"), which fails host verification.
- github.com and www.microsoft.com serve their real certificate with or without SNI, and they are the only hosts that work.
- The failure comes after about one network round trip, before any HTTP response. The Cloudflare / Supabase logs show no request at all.

Additional detail: a ClientHello captured from build 6294 (sent to a local listener) offers TLS 1.3 and 1.2, groups P-521, P-384, P-256, secp224r1 and ffdhe8192 (no X25519), with a P-256 key share.

Expected: WebRequest() and SocketConnect() send the host name in the TLS server_name extension, as build 6254 does.

Related reports: https://www.mql5.com/en/forum/517438 and https://www.mql5.com/en/forum/517711 (1001 / 5203 after builds 6230 and 6241).

Test script (add the three URLs to the allow-list first):

//+------------------------------------------------------------------+
//| SniProbe.mq5 - WebRequest against hosts with and without SNI.    |
//+------------------------------------------------------------------+
void Probe(const string url)
  {
   uchar  data[], res[];
   string hdr = "";
   ResetLastError();
   int code = WebRequest("GET", url, "", 10000, data, res, hdr);
   PrintFormat("%s -> WebRequest=%d GetLastError=%d, %d header chars, %d body bytes",
               url, code, GetLastError(), StringLen(hdr), ArraySize(res));
  }

void OnStart()
  {
   PrintFormat("build %d", (int)TerminalInfoInteger(TERMINAL_BUILD));
   Probe("https://github.com/");        // serves its certificate without SNI
   Probe("https://www.microsoft.com/"); // serves its certificate without SNI
   Probe("https://www.google.com/");    // requires SNI
  }
GitHub · Change is constant. GitHub keeps you ahead. · GitHub
GitHub · Change is constant. GitHub keeps you ahead. · GitHub
  • github.com
Join the world's most widely adopted, AI-powered developer platform where millions of developers, businesses, and the largest open source community build software that advances humanity.
2026.11.03 08:56:00.507    519801 (EURUSD,M1)    build 6296
2026.11.03 08:56:00.673    519801 (EURUSD,M1)    https://github.com/ -> WebRequest=200 GetLastError=0, 5660 header chars, 530035 body bytes
2026.11.03 08:56:01.155    519801 (EURUSD,M1)    https://www.microsoft.com/ -> WebRequest=200 GetLastError=0, 1289 header chars, 199952 body bytes
2026.11.03 08:56:01.348    519801 (EURUSD,M1)    https://www.google.com/ -> WebRequest=200 GetLastError=0, 1476 header chars, 86890 body bytes
New comment