4 ms·
I was wondering what happens if you skip the SNI bit and just rely on the Host header in the data. Does that work?
by KayEss 7y ago
I was wondering what happens if you skip the SNI bit and just rely on the Host header in the data. Does that work?
- andreareina 7y agoThat's called "domain fronting", the major cloud providers disallow it and enforce that the Host header must match the SNI.
- yardstick 7y agoThis is likely the major reason why China has not yet blocked the major cloud providers. As soon as they allow ESNI/domain fronting, all bets are off as to what China will block.
- lostmsu 7y agoThey explicitly started doing this after Telegram used domain fronting to work around Russian censorship, which caused large chunks of AWS and GCP addresses to be blocked in Russia.
- richardwhiuk 7y agoYou can only do that if you can present a single valid certificate for all of the hosts behind the IP address.