TLS SNI (Server Name Indication)
Server Name Indication (SNI) is a TLS extension, defined in RFC 6066, that lets a client state which hostname it is trying to reach inside the initial ClientHello message, before the TLS handshake completes. It exists because a server hosting multiple HTTPS sites on one IP address otherwise has no way to know which certificate to present until after the encrypted session is already being negotiated; SNI lets it pick the right one up front, which is what makes shared-IP HTTPS hosting practical at scale. Because the ClientHello is sent before encryption is established, a plain SNI value is visible in cleartext to anything observing the connection, revealing which site a client is visiting even though the rest of the session is encrypted -- the gap Encrypted Client Hello (ECH, RFC 9849) is designed to close, though deployment still varies widely by browser and server.
By AdminKit team, Netbase JSC · Updated