I believe that what you're missing is that in the case that the ClientHelloInner decryption fails, the communication is still encrypted with the fallback public

I believe that what you're missing is that in the case that the ClientHelloInner decryption fails, the communication is still encrypted with the fallback public SNI. > Server sees that decryption fails and proceeds with the ClientHelloOuter handshake, sending back the correct public key. Before sending back the correct public key for the private SNI (which in itself if done unencrypted would compromise the client's privacy), it establishes an encrypted communication session with the public SNI from the ClientHelloOuter, e.g. cloudflare.com. That is, the correct public key for the ClientHelloInner is only sent back after the ClientHelloOuter handshake. This is at least what I understood from reading https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-08#section-6.3 https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-08...