Skip to main content
protocols.pageprotocols.page
tls

SNI (Server Name Indication)

SNI is a TLS extension that sends the requested hostname in the ClientHello message, allowing one IP address to serve multiple TLS certificates. Without SNI, each HTTPS site needs its own IP. SNI is sent in cleartext – Encrypted Client Hello (ECH) encrypts it to prevent network observers from seeing which site is being accessed.

Definition

Server Name Indication solves the virtual hosting problem for HTTPS. Before SNI, a server receiving a TLS connection on a shared IP could not determine which certificate to present because the Host header is encrypted inside TLS. SNI sends the hostname in the unencrypted ClientHello, allowing the server to select the correct certificate before encryption begins. All modern browsers support SNI (IE on Windows XP was the last holdout, EOL 2014). The privacy cost is that network observers (ISPs, firewalls, censors) can see which hostname is being accessed by reading the SNI field. Encrypted Client Hello (ECH, formerly ESNI) encrypts the SNI using a public key published in DNS, preventing hostname surveillance. Cloudflare deploys ECH for all domains behind their CDN.

Examples

  • –openssl s_client -connect host:443 -servername example.com (sends SNI)
  • –Nginx: multiple server{} blocks with different ssl_certificate on same IP
  • –curl --resolve example.com:443:IP https://example.com (tests SNI routing)

Related Protocols

tls

Related Terms

TLS Termination

TLS termination is the practice of decrypting TLS traffic at a load balancer or reverse proxy rather than at the application server. The proxy handles certificate management, cipher negotiation, and CPU-intensive cryptographic operations. Backend traffic between proxy and application runs over HTTP (or re-encrypted with a simpler internal cert).

ALPN (Application-Layer Protocol Negotiation)

ALPN is a TLS extension that negotiates the application protocol (HTTP/1.1, h2, h3) during the TLS handshake, eliminating an extra round trip. The client lists supported protocols in ClientHello; the server selects one in ServerHello. HTTP/2 requires ALPN – browsers will not use h2 without it. Also used for ACME tls-alpn-01 validation.