SNI
acronymcryptographynetworking
Stands for: Server Name Indication
The field in a TLS handshake that names which site the client wants.
Server Name Indication (RFC 6066) lets one IP address host many TLS sites: the client sends the hostname in the ClientHello so the server can present the right certificate. It is sent in the clear in TLS 1.2, which is why Encrypted Client Hello exists.
Server Name Indication exists because TLS and virtual hosting were designed with incompatible assumptions. HTTP puts the requested hostname in a header, but that header is inside the encrypted session, and the server must choose a certificate before decryption begins. Without SNI, one address could serve exactly one certificate.
So SNI carries the hostname in the handshake, in the clear. That solved hosting economics and created a privacy consequence that took years to address: anyone on the path can see which site you are visiting even though the content is encrypted. Encrypted Client Hello is the response, and its deployment is complicated precisely because middleboxes came to depend on reading SNI.
Operationally, this is where mismatches surface. A client that sends one name while requesting another, a load balancer matching on SNI rather than Host, and a wildcard certificate that covers one but not the other all produce failures that look like certificate problems and are really name-selection problems. Knowing which name the decision was made on is usually the whole diagnosis.
Also known as: sni