SNI

Hundreds of websites can run on one server IP address. So that the server knows which certificate to present, the program sends the site name before encryption starts. This is SNI.

The SNI field is usually not encrypted. So even without access to the contents, the network and the proxy can see which site you are going to, but not the page addresses or the data.

This is how a proxy service can keep a record of domains without knowing what happens inside the connection. Read more about encryption in the TLS article.

Prokso does not store contents, page addresses or passwords; only domains, time and volume are kept for 90 days to handle complaints.

Where exactly SNI sits in the connection

SNI is an extension of the ClientHello message, the first packet of the TLS handshake. The field is called server_name and carries the host name, for example example.com, without the path and without the port. The server reads it and picks the certificate before any keys are agreed.

Through an HTTP proxy the site name appears twice: first in the line CONNECT example.com:443 for the tunnel, then in SNI inside the tunnel. The proxy reads only the first one; the second goes to the site as is. Normally both names match.

Why connecting by IP address breaks HTTPS

The standard allows only a host name in SNI, not an IP address. If a program opens https://203.0.113.10/, it sends no name, and a server with many sites returns its default certificate. The result is a name mismatch error, even though the site itself works. So in program and script settings, enter the site name, not its IP.

When you need to reach a specific server address while keeping the name, use curl --resolve example.com:443:203.0.113.10 https://example.com/. curl connects to the given address but sends example.com in SNI and in the Host header.

How to see which certificate a name returns

The command openssl s_client -connect example.com:443 -servername example.com sets the SNI value explicitly and prints the certificate the server chose. Compare the names in the certificate with the name of the site: it must be in the subject field or in the list of alternative names. The pattern *.example.com covers shop.example.com, but not example.com itself and not a.shop.example.com. If a wrong certificate appears only when you work through the proxy, open the certificate errors page.