# What Is SNI (Server Name Indication)? Definition and Examples

> SNI is a TLS extension that carries the requested hostname in the ClientHello, letting one IP address serve many HTTPS sites with different certificates.

Source: https://ssl.sh/glossary/sni/
Last updated: 2026-11-10

Server Name Indication is the `server_name` extension defined in [RFC 6066](https://www.rfc-editor.org/rfc/rfc6066). The client puts the DNS hostname it wants in the ClientHello, before any certificate is exchanged, and the server uses that name to pick the matching certificate and virtual host. RFC 6066 allows only DNS names in this field; literal IP addresses are not permitted.

## Why it matters
Without SNI, a server learns the hostname only after the handshake, from the HTTP Host header, so it can present just one certificate per IP address and port. SNI is what makes shared hosting, CDNs and load balancers with thousands of HTTPS sites on one IP possible. If a client omits SNI or sends a name the server does not know, the server falls back to its default certificate, which usually surfaces as a name-mismatch error. SNI is also sent in plaintext, even in [TLS 1.3](https://ssl.sh/glossary/tls-1-3/), so anyone on the network path can see which hostname is requested; [ECH](https://ssl.sh/glossary/ech/) is the standard way to hide it.

## Example
Ask one IP address for a specific virtual host; `-servername` sets the SNI value:

```bash
openssl s_client -connect 203.0.113.10:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -ext subjectAltName
```

Run it again without `-servername`. If a different certificate comes back, the server is choosing certificates by SNI and the second one is its default.

## Common misconceptions
- **Every HTTPS site needs its own IP address.** That was true before SNI. All mainstream browsers and HTTP clients send SNI today, so many certificates can share one IP.
- **TLS 1.3 encrypts the SNI.** It does not. TLS 1.3 encrypts the server certificate but leaves SNI in the clear; hiding it requires ECH.
- **SNI and the certificate's SAN are the same thing.** SNI is the name the client asks for; the [SAN](https://ssl.sh/glossary/san/) list is what the certificate covers. The connection is valid only if the requested name matches a SAN entry.

## Related terms

- [TLS 握手](https://ssl.sh/zh/glossary/tls-handshake/): TLS 握手是 TLS 连接开始时的一组消息交换，客户端与服务器在其中协商协议版本和密码套件、验证服务器身份并派生会话密钥。
- [ECH](https://ssl.sh/zh/glossary/ech/): ECH 是 TLS 1.3 的扩展，用发布在 DNS 中的公钥加密 ClientHello 的敏感部分（包括 SNI），链路上只能看到前端服务器的公共名称。
- [ESNI](https://ssl.sh/zh/glossary/esni/): ESNI 是一个已被放弃的 TLS 1.3 草案，用发布在 DNS 中的公钥只加密 SNI 字段，现已被 ECH 取代。
- [SAN](https://ssl.sh/zh/glossary/san/): SAN 即主体备用名称，是 X.509 证书中列出其适用的所有域名、IP 地址等身份的扩展，客户端按它校验主机名。
- [TLS 1.3](https://ssl.sh/zh/glossary/tls-1-3/): TLS 1.3 是当前最新的传输层安全协议版本（2018 年的 RFC 8446，现行规范为 RFC 9846），完整握手只需一个往返，且只保留 AEAD 加密算法。
- [多域名证书](https://ssl.sh/zh/glossary/multi-domain-certificate/): 多域名证书是在 SAN 扩展中列出多个不同主机名、让一张证书同时保护多个域名的 TLS 证书。
- [ALPN](https://ssl.sh/zh/glossary/alpn/): ALPN 是一个 TLS 扩展，让客户端和服务器在握手过程中直接商定上层协议，例如 h2 或 http/1.1，不需要额外往返。