SNI (Server Name Indication) — TLS Handshake Flow

How an edge server picks the right certificate from a plaintext SNI hostname during ClientHello

PREREQUISITES • TLS 1.2+/1.3 client • Multiple certs hosted on same IP • Edge server / reverse proxy configured • Valid cert issued for each hostname TLS connect 1 ⚡ Client / Browser Send ClientHello SNI: example.com sent in cleartext hostname 2 ⚡ Edge server Extract SNI Parses hostname from ClientHello extension lookup 3 🔗 Cert store Check certificates siteb.com / example.com / sitec.com — same IP SNI match found? Yes No ✗ Edge server No SNI match No cert configured for requested SNI hostname 🔍 Client / Browser Hostname mismatch SNI hostname ≠ certificate CN/SAN Handshake aborted SNI / cert mismatch 4 ⚡ Edge server Present matched cert Serves the example.com certificate 5 ⚡ Client + Server Complete handshake Key exchange & session keys derived Session encrypted for example.com Legend Automated Step Integration / cert store Start / End Decision Prerequisite Cert mismatch / failure path

Prerequisites

  • • TLS 1.2 or 1.3 stack on client
  • • Edge server hosting multiple certs on one IP
  • • Reverse proxy / load balancer SNI routing enabled

Inputs → Outputs

  • • Input: ClientHello with SNI hostname
  • • Output (match): matched X.509 certificate
  • • Output (no match): aborted handshake, cert CN mismatch

Tools & Integrations

  • • TLS stack (OpenSSL / BoringSSL)
  • • Edge proxy (nginx, Envoy, ALB, Cloudflare)
  • • Certificate store / SNI dictionary

SNI (Server Name Indication) Handshake • TLS 1.2/1.3 • Ethical Hacking Lesson