SNI

Also called server name indication, ECH, encrypted client hello

The site name sent in the clear at the start of a TLS handshake, so the server can pick a certificate.

Everything after the handshake is encrypted, but the name, the addresses, the timing and the sizes stay visible to the path. Encrypted Client Hello (ECH) is the newer fix for the name.

See it on real machines

Learn it on real machines.

Every lab is a small network of real Linux machines in your browser. Start with a free account: Google or email, no card.

Open this lab