Encrypted Client Hello hides Server Name Indication (SNI). However, looking at the TLS Handshake (https://tls12.ulfheim.net/). Wouldn't it be possible for a middle-man to inspect the TLS Handshake and sniff ServerHello to see the x509 certificate (before the Handshake completes)? It should contain the subject alt names and expose the server correct?
My Understanding is that with ECH, a middleman will only be able to determine the IP address of the client and server but not what service the client was visting exactly. But if they can see the x509 certificate chain, that doesn't seem to be the case.
TLDR: Can a man in the middle inspect certificates in TLS handshakes to determine what clients were visiting even with ECH?