4 ms·

Could you elaborate? What's the problem with SNI? (I haven't dived deep into these protocols)

• mschuster91 7y ago
  SNI exposes the target domain to everyone with sniffing capabilities - including everyone on your private/corp network as well as all involved ISPs.
  • gruez 7y ago
    That's an non issue because the target domain is in certificate that the server sends back. This happens with or without SNI.
    • toast0 7y ago
      In TLS 1.3, the certificate is now sent encrypted with an ephemeral key. A given IP can serve differwnt certificates depending on SNI, so if SNI can become unsniffable, determining the certificate based on observing traffic to the server as well as generating traffic would be much harder for shared IPs anyway.