Sniffing the SNI from the underlying TCP connection is the proper way to do this. a couple examples I know of(only know go ones of the top of my head): https:

Sniffing the SNI from the underlying TCP connection is the proper way to do this. a couple examples I know of(only know go ones of the top of my head): https://github.com/fabiolb/fabio/blob/master/proxy/tcp/tls_clienthello.go https://github.com/fabiolb/fabio/blob/master/proxy/tcp/tls_c... https://github.com/FiloSottile/mostly-harmless/blob/main/talks/asyncnet/tls.go https://github.com/FiloSottile/mostly-harmless/blob/main/tal... > I don't like doing that but the only other way is to "roll my own crypto" which I understand is a bad thing. You would not be rolling your own cryptographic primitive, or combining existing ones in strange and speculative ways. This is what most people, most of the time mean when they admonish against rolling your own crypto. All you'd have to do is parse the ClientHello to retrieve the SNI. you're in a memory safe language, so parsing bugs result in a crash, not a buffer overflow. I'd say you're on pretty firm ground.