Server Name Indication (SNI) is a TLS protocol extension that lets a client send the target hostname as part of the ClientHello message at the start of the TLS handshake, before the server sends its certificate. This solves the problem of name-based virtual hosting for HTTPS — multiple domains with different certificates can now share a single IP address.
Without SNI, a server couldn't know which certificate to present until after it read the TLS handshake request; with SNI, the hostname is visible upfront in plaintext, so the server selects and returns the correct SSL certificate for that domain. This became critical as HTTPS adoption scaled and IPv4 addresses became scarce.
Example: One server IP hosts both example.com and example.org. When a client connects to example.org, it includes server_name = example.org in the ClientHello. The server reads this and responds with the certificate for example.org instead of a default or mismatched certificate.
WarningSNI is sent in cleartext in the ClientHello — the hostname is visible to network observers, firewalls, and ISPs even though the rest of the session is encrypted. This enables hostname-based censorship despite HTTPS. Encrypted Client Hello (ECH), a proposed TLS extension, aims to encrypt SNI in future, but adoption is still emerging.
Legacy TLS clients (Windows XP, Android <2.3, old Java) don't support SNI and will fail certificate validation on shared-IP multi-domain hosting. Modern clients, browsers, and systems have supported SNI since the mid-2000s. SNI is defined in RFC 6066 and carried unchanged into TLS 1.3.