4 ms·
[..] domain names are exposed in plain-text within the https request. Only if your handshake negotiates to use SNI.
by mh- 10y ago
[..] domain names are exposed in plain-text within the https request.
Only if your handshake negotiates to use SNI.
- deleted 10y ago[deleted]
- hsivonen 10y agoSNI is sent even if the server ignores it.
- EvilTerran 10y agoAnd even if your client software doesn't use SNI... the server has to send you the cert before an authenticated encrypted channel can be established, so the cert's snoopable - and has the domain name in it.