What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
SNI (Server Name Indication) is a TLS extension that tells a server the DNS hostname a client wants to reach during the TLS handshake. It lets one IP address serve multiple HTTPS sites by helping the server choose the right service and certificate. In ordinary TLS, that hostname is visible in the initial ClientHello; TLS 1.3 does not encrypt it by itself.
What does SNI stand for?
SNI stands for Server Name Indication. The extension is called server_name in the TLS standards. It carries a hostname from the client to the server as the TLS connection is being set up.
As RFC 6066 explains, “TLS does not provide a mechanism for a client to tell a server the name of the server it is contacting.” SNI supplies that name so a server can distinguish the requested site from other services sharing the same network address.
Why does HTTPS use SNI?
A web address such as https://example.com gives the browser a hostname. The browser resolves that hostname to an IP address and connects to it, but multiple websites may use the same address. The IP address alone may therefore not identify which site’s TLS configuration the browser needs.
#1 Best Overall
The client includes the requested DNS hostname in the SNI extension of its TLS ClientHello. The server can use it to select the appropriate virtual service and certificate. This is particularly useful for HTTPS hosting, and RFC 9325 recommends that TLS implementations support SNI for higher-level protocols that benefit from it, including HTTPS. Whether it is used in a particular connection can still depend on local policy.
How does SNI work in a TLS connection?
- The client gets the hostname. It typically comes from the URL or other application context, such as
example.com. - The client resolves the name and connects. DNS resolution supplies an IP address; the client opens a connection to that address.
- The client sends a ClientHello. As part of starting TLS, it can include the
server_nameextension with the hostname it wants. - The server selects a service context. If the address hosts multiple sites, the server can use the name to choose the right virtual service and certificate.
- The client checks the server identity. SNI helps the server make a selection; it does not establish that the server is trustworthy. The client still validates the identity presented for the requested hostname and decides whether to proceed if it does not match.
What kind of name can SNI contain?
The standard’s HostName value is a DNS hostname encoded as ASCII, without a trailing dot. Internationalized domain names are represented using ASCII-compatible A-labels, and hostnames are case-insensitive. Literal IPv4 and IPv6 addresses are not allowed in this SNI field.
Is SNI encrypted?
In conventional TLS, the SNI hostname is sent in the initial ClientHello in cleartext. TLS 1.3 encrypts more of the handshake after it begins, including the server certificate in transit, but that does not conceal the ordinary SNI value already sent in the initial ClientHello.
Encrypted ClientHello (ECH) is a separate mechanism designed to encrypt sensitive inner ClientHello content, including the server name. It is distinct from TLS 1.3 itself. The cited standards describe the protocol and its privacy goals, but do not establish current deployment coverage across clients, resolvers, and servers.
Rank #3
- Used Book in Good Condition
Does encrypted DNS hide SNI?
No. DNS privacy and SNI privacy concern different parts of a connection. Encrypting a DNS query does not, by itself, hide a hostname that the client later sends in a visible TLS ClientHello. RFC 8744 discusses how visible SNI can expose information to intermediaries and the privacy considerations involved in encrypting it.
Quick Recap
Best Value
Sources
- RFC 6066: Transport Layer Security (TLS) Extensions: Extension Definitions (IETF, January 2011), which specifies the
server_nameextension and hostname format. - RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 (IETF, August 2018), which describes SNI’s role in certificate selection.
- RFC 8744: Issues and Requirements for Server Name Identification (SNI) Encryption in TLS (IETF, March 2020), which discusses cleartext SNI and privacy.
- RFC 9325: Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) (IETF, November 2022), which recommends SNI support for protocols including HTTPS.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
