If I do a packet capture on an https session where SNI is involved, the Client Hello reveals, in plaintext, the hostname that I'm requesting.
I believe that before SNI, there was nothing in an SSL/TLS packet itself that could identify the site somebody was trying to hit. I'm thinking of systems that monitor or filter based on hostname requested. With SNI, they have the ability to do that, even for TLS-encrypted traffic (based on the plaintext Client Hello), whereas they didn't before SNI.
If I install a non-SNI certificate (if I could even get one anymore), does the client still identify itself in the Client Hello packet? Is that just inherent in TLS 1.2 and my references to the SNI "problem" is actually a TLS 1.2 "problem?"