SNI is part of the Client Hello part of TLS, (it's needed so the server can decide the appropriate SSL certificate to reply with), and since this happens at sta

SNI is part of the Client Hello part of TLS, (it's needed so the server can decide the appropriate SSL certificate to reply with), and since this happens at start of TLS handshake, it's transmitted in plaintext. Many Firewalls (and even my ISP), terminates the connection here if the domain is the blocklist. Since it's part of SSL negotiation, and unrelated to the actual HTTP query, in some cases you can find another (non blocked site) on the same server, send that SNI for TLS handshake, and then do the http request on the correct host to bypass stuff like this. (This technique is called domain fronting [1]). Unfortunately big CDNs like Cloudflare stopped allowing this because it's non-standard. There is a proposal for Encrypted Client Hello (and therefore Encrypted SNI) being worked on right now: draft-ietf-tls-esni-14 [2], till then using VPN/Web proxies are the only effective way of getting around these restrictions. [1] https://en.wikipedia.org/wiki/Domain_fronting https://en.wikipedia.org/wiki/Domain_fronting [2] https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/