I'm looking at packet captures of TLS traffic, and I see TLS-encrypted connections where the SNI field contains a long hex string (a sequence of 64 hex nibbles) -- not a domain name.
What might trigger this? I'm used to HTTPS clients putting a domain name in the SNI field (the domain name of the web server they're trying to contact). Is there a TLS extension that suggests putting a hex string or hash fingerprint in the SNI field? Or is there some non-HTTPS protocol that uses TLS and puts a hex string or fingerprint in the SNI field?
The SNI spec (RFC 6066) doesn't say anything about this. It provides for SNI to carry a hostname, not any other type of value. I haven't been able to find any TLS extension that would explain this.