SNI

SNI (Server Name Indication) is an extension of the TLS protocol that lets a single server host many HTTPS sites with separate SSL certificates on the same IP address. It solves a fundamental problem: without SNI the encrypted connection had to be established before the server learned which domain was requested — so one IP address could present only one certificate.

How SNI works

In a traditional HTTPS connection the client first negotiates encryption and only then sends the header with the domain name. The trouble is that the server must present a certificate during the negotiation stage — before it knows which site the client is asking for. SNI fixes this by attaching the host name to the very first greeting message (ClientHello), before the channel is encrypted.

The server reads the supplied name, selects the correct certificate for it and only then continues the HTTPS handshake. It is worth knowing that in classic SNI the domain name travels in plain text — which is why the Encrypted SNI (ESNI) extension and the newer Encrypted Client Hello (ECH) were created to hide that information from eavesdroppers.

SNI in practice

Today SNI is the foundation of shared and virtual hosting. It allows hundreds of HTTPS sites to live on a single IP address, which conserves the shrinking pool of IPv4 addresses and lowers costs. Hosting providers and CDNs build their virtual hosts on it, and without this mechanism every domain with a certificate would need its own dedicated IP address. For a site owner SNI works entirely behind the scenes — you simply install a certificate and the server presents the right one on each request.