Skip to content
Get Started
G2G2
4.7/5
Excellent
Trustpilot

What Is SNI (Server Name Indication)?

SNI (Server Name Indication) is a TLS extension in which the client names the website it wants at the start of the handshake. It lets one server IP host many HTTPS sites and pick the right certificate, but the name travels unencrypted unless Encrypted Client Hello is used.

Try Now for $4.99Continue with Google
  • Session Control
  • High Speed
  • Privacy First
Best fit for SNIStatic ISP Proxiesfrom$0.75/IP
how it works

How SNI works

Before SNI, a server had to choose a certificate before it knew which site the client wanted, so each HTTPS site needed its own IP address. SNI, defined in RFC 6066, adds a server_name field to the TLS ClientHello. The server reads it, picks the matching certificate and carries on. Shared hosting, CDNs and cloud load balancers depend on it.

Because the ClientHello is sent before any keys exist, the hostname in it is visible to anyone on the path. Encrypted Client Hello (ECH) fixes that by encrypting the inner ClientHello, and recent versions of Chrome and Firefox support it for sites that publish an ECH key, mostly behind Cloudflare.

why it matters

Why SNI matters for proxy users

An HTTPS request through a proxy hides the page, not the destination. The hostname is visible in more than one place, and the website checks that they agree.

  • 1

    CONNECT host:443 line

    Visible to the proxy
    Yes, it opens the tunnel with it
    Visible to the website
    No
  • 2

    SNI in the ClientHello

    Visible to the proxy
    Yes, unless ECH is used
    Visible to the website
    Yes
  • 3

    Host header

    Visible to the proxy
    No, encrypted in the tunnel
    Visible to the website
    Yes
  • 4

    URL path, cookies, body

    Visible to the proxy
    No, encrypted in the tunnel
    Visible to the website
    Yes

The SNI and the Host header must name the same site. Servers and CDNs reject mismatches (domain fronting), often with 421 Misdirected Request or a certificate error, and an empty or IP-only SNI from a client that claims to be a browser is itself a bot signal.

CleanProxies proxies pass your TLS handshake through unchanged, SNI included. Use static ISP proxies or rotating residential proxies with any client that sets SNI correctly, which every browser and mainstream HTTP library does.

Static ISP proxies from $0.75/IP

The CleanProxies proxy that fits best here, with a $4.99 trial to test it first.

Static ISP Proxies

Best fit

Dedicated IPs on US carrier ASNs with unlimited bandwidth and threads, never shared.

starting from$0.75/IP

Dedicated static IPs registered to US and Canadian ISPs. The address stays the same for as long as you hold it, with unlimited bandwidth and HTTP(S) or SOCKS5 access.

Buy NowSee Static ISP Proxies features

Go deeper

Guides from the blog

Setup guides and best practices from the CleanProxies blog.

Get the latest insightsAll Blogs

Related terms

Terms that come up alongside SNI.

All glossary terms

SNI FAQs

Straight answers about SNI.

Server Name Indication, a TLS extension that tells the server which hostname the client is connecting to.

Got more questions?All FAQs