It seems like it must actually do a DNS lookup to have established the matching IPv6 address, so you're not even saving that. (edit: Or maybe it just ignores DN

It seems like it must actually do a DNS lookup to have established the matching IPv6 address, so you're not even saving that. (edit: Or maybe it just ignores DNS totally at this point and operates off having seeing the second hostname in the certificate it got before? That seems like it would cause more issues though.) I'm not sure I totally buy that the spec does allow it (since the "authoritativeness" rules for HTTPS are defined as being in addition to those for HTTP), but beyond that it is a little hard to imagine what purpose there is to be overly-greedy like this in matching up for reused connections.