sni

Server Name Indication (SNI) is a TLS extension that allows a client to indicate the hostname it is trying to reach during the TLS handshake. This enables a server that hosts multiple domains on a single IP address to select the correct certificate for the requested host, facilitating secure connections to many sites over one IP.

In practice, the client includes a server_name in the TLS ClientHello. The server uses that value to choose the appropriate X.509 certificate to present. If no certificate matches the requested host, the server may present a default certificate or terminate the handshake, which can result in a certificate name mismatch error for the client.

SNI is widely used to support virtual hosting for HTTPS. It is implemented by major web browsers, TLS libraries, servers, and content delivery networks, and it underpins the common practice of serving multiple HTTPS sites from a single IP address or load balancer.

Privacy and limitations: the hostname is transmitted in cleartext within the TLS handshake, so network observers can see which domain is being accessed. This has privacy implications and has led to proposals and workarounds to encrypt the server name or the entire handshake in some scenarios. Some legacy clients, proxies, or corporate networks may not correctly support SNI, potentially causing connection failures or certificate errors.

Overall, SNI remains a foundational feature for modern HTTPS deployments on shared infrastructure, with ongoing efforts to address its privacy trade-offs.