recently (last week?) internet in iran has started blocking https websites again. they did this before but that was, as far as I know, ip based. but it seems that the new blockage in not ip based but domain based.

a test with curl -vvv https://www.domain.first curl -vvv https://www.domain.second shows that curl tried to connect to same IP in both cases but in the first case it gets stuck in hello stage of https.

is tls domain based? for supporting multiple website on same ip?. but does that expose the domain in the initial negotiation? I always thought that tls used IP? I am not a network pro, so sorry if this is not clear.

  • 4
    Vanilla TLS is IP-based, which is why multiple domains sharing the same IP address can't all have their own certificates. The problem is that the Host header, which would provide the correct domain name, is encrypted and can't be read before decryption takes place. There is an extension to TLS, Sever Name Indication, which allows multiple domains to share the same IP and still have their own certificates by transmitting the server name in plaintext. Mar 7, 2017 at 18:35

2 Answers 2


What you seem to be seeing is related to Server Name Indication, which is basically the TLS equivalent of HTTP's Host: header.

Per that same wikipedia article:

Therefore, with clients and servers that implement SNI, a server with a single IP address can serve a group of domain names for which it is impractical to get a common certificate.

Practically, SNI is basically a record sent during the TLS session setup - the High Performance Browser Networking book provides an overview of the handshake, and also provides a specific section on SNI, summarised as:

The TLS+SNI workflow is identical to Host header advertisement in HTTP, where the client indicates the hostname of the site it is requesting: the same IP address may host many different domains, and both SNI and Host are required to disambiguate between them.

tl;dr: SNI allows an observer to identify the specific domain a TLS request relates to. It can also be used, as was recently reported by FireEye, to obfuscate the 'real' target of a connection - e.g. you can have an SNI to google.com, but a Host: header for youtube, and this (currently) will allow you to browse content from youtube without exposing the fact.


Maybe this article and the hyperlink inside it can help.


  • 3
    please do not post just the links - include the relevant parts of the link in your answer
    – schroeder
    Mar 10, 2017 at 7:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .