Skip to content
ecdsa.com

SNI (Server Name Indication)

The TLS extension (RFC 6066 §3, extension 0) in which the client names the host it wants, so one IP address can serve many certificates; it is sent in clear text unless Encrypted Client Hello is used.
Also written asServer Name Indicationserver_nameTLS SNI

The client puts a DNS host name (not an IP address; RFC 6066 forbids literal addresses) in server_name; the server uses it to pick a certificate and configuration. Without SNI, servers fall back to a default certificate, which is the usual cause of "certificate is for the wrong host" when a client omits it, for example openssl s_client without -servername in old versions or misconfigured HTTP clients.

The plaintext name is visible to networks, which use it for filtering, censorship and analytics. Encrypted Client Hello (RFC 9849) moves the real name into an encrypted inner ClientHello and shows only a shared public name in the outer one.

Standards and references

All terms