I've read that the Great Firewall now blocks TLS 1.3 connections with ESNI.

Is TLS 1.3 usable without ESNI, or does the user have to downgrade to TLS 1.2?


The default way to use TLS 1.3 is without ESNI. It just uses SNI, like TLS 1.2 before it.

You can even use it without SNI at all, and either the server will close the connection, or give you a certificate that doesn't cover the domain you want which will cause the client to close the connection (unless you override the cert verification logic) or it will give you a cert that covers the domain you want and everything will work great, all depending on the configuration of the web server or TLS terminator.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.