wp-cron.php should use SNI

[dmole]

> grep "SNI was provided" /var/log/apache2/error.log | tail -n 1
[Tue Sep 09 12:42:40.051340 2025] [ssl:error] [pid 605:tid 687] [client REDACTED_LOCAL_IP:44088] AH02032: Hostname REDACTED_DOMAIN_1 (default host as no SNI was provided) and hostname REDACTED_DOMAIN_2 provided via HTTP have no compatible SSL setup

> grep "09/Sep/2025:12:42:40" /var/log/apache2/other_vhosts_access.log
REDACTED_DOMAIN_2:443 REDACTED_LOCAL_IP - - [09/Sep/2025:12:42:40 -0400] "POST /wordpress/wp-cron.php?doing_wp_cron=1757436160.0413179397583007812500 HTTP/1.1" 421 3908 "-" "WordPress/6.8.2; https://REDACTED_DOMAIN_2"

[dmole]

Maybe use CURLOPT_RESOLVE or CURLOPT_CONNECT_TO before CURLOPT_URL in Requests/src/Transport/Curl.php

[mschluepmann]

I think the severity is at least major. We have a this problem here with about 130 WordPress-Installations at the moment.

Keep Server Name Indication enabled for HTTPS requests when certificate verification is disabled. The streams transport currently disables SNI when verifyname is false, but certificate verification and SNI are independent. This affects the HTTP request used by WP-Cron when sslverify is false and can cause virtual hosts to return a 421 response.

The change follows the corresponding Requests transport fix and regression coverage: ​https://github.com/WordPress/Requests/commit/213f7e7

Use of AI Tools

AI assistance: Yes
Tool(s): OpenAI Codex
Model(s): GPT-6
Used for: Ticket investigation, implementation, and validation. The code change and PR content were reviewed before publication.