Search the Community
Showing results for tags 'esni'.
Found 1 result
Server Name Indication (SNI) transmits a virtual domain name during the TLS negotiation process so that a server with a single IP address can support multiple virtual domains, instead of requiring a unique IP address for each TLS host. SNI does not conceal the requested hostname so it can be used for network filtering which is a privacy concern. ESNI - Encrypted SNI - replaces the server name in the ClientHello message with an encrypted equivalent. It is placed in the DNS records as a TXT record. It has a checksum which uses the first 4 octets of the SHA-256 message digest, padding, and a validity period. However the specifications suggest the expiry date should not be used for caching to allow servers to rotate the encryption keys.