What is SNI (Server Name Indication)?

Short answer

SNI (Server Name Indication) is the TLS extension with which the client states the domain it wants to connect to in the first message of the TLS handshake (ClientHello). Since the domain is known before encryption starts, different certificates can be served for multiple sites on the same IP and port. In TR7, SNI determines which certificate is served when more than one certificate is selected in the Certificate field of the vService; it is also used in the SSL SNI Info condition (only on an L7 TCP vService that does not terminate SSL), in the SNI field of the Backend Service and in the SNI/Host Validation setting in the TLS Security Profile. When TLS is terminated on TR7, the SNI-based decision is made through a Dynamic Condition with the SNI Received from Client variable.

Where It Is Used in TR7

Where	Field / label	What for
HTTP vService and L7 TCP vService	Certificate (more than one certificate)	Serving the certificate that matches the client's SNI; if there is no SNI or it matches none of the certificates, the first certificate in the list is served
HTTP vService → Virtual Hosting	Domain name list	Among the vServices that share the same IP:port, routing the encrypted connection to the relevant vService based on SNI
Load Balancer → Conditions (Policy Match)	SSL SNI Info	A decision based on SNI; it matches only on an L7 TCP vService that does not terminate SSL (passthrough), and does not match on an HTTP vService or on an L7 TCP vService that terminates SSL; when TLS is terminated, the SNI-based decision is made through a Dynamic Condition with SNI Received from Client
Backend Service → SSL Service	SNI	The name TR7 sends when it connects to the Backend Service with TLS (HTTP vService)
Certificates & PKI → TLS Security Profiles	SNI/Host Validation	Rejecting with 421 the requests whose SNI and Host header do not match (HTTP vService)
Load Balancer → Profiles (L4-L7 Behavior Sets) → Health Checks	Virtual Domain (Host/SNI)	The Host / SNI value sent in the health check request
Smart Variables	Request SSL SNI info	Using the client's SNI value in logs, headers or actions; it is filled only when TLS is not terminated (passthrough), and when TLS is terminated, SNI Received from Client is used

Common Misconceptions

• "SNI is encrypted." The SNI in ClientHello travels as plain text; the domain being connected to can be seen on the network (RFC 6066).
• "SNI and the Host header are always the same." The client can send different values; if SNI/Host Validation is on, these requests are rejected with 421 (What is 421 Misdirected Request?).
• "SNI matters only on the vService side." TR7 can also send SNI when it connects to the Backend Service with TLS; this is required if the server hosts multiple sites on the same IP (I need to send SNI when connecting to the backend; how do I set it up?).

How it is done in the documentation

• HTTP (L7) vService · Certificate
• SSL SNI Info
• Backend Services · SNI
• TLS Security Profiles · SNI/Host Validation

Related questions

• Can I attach more than one certificate to a vService; how is the right certificate selected (SNI)?
• Can I serve different certificates for different domains on the same IP:443 (SNI)?
• With passthrough, can I route to different backends based on SNI?
• Can I reject requests whose SNI and Host Header do not match (domain fronting) (SNI/Host Validation)?