server_name
Server Name Indication (SNI): the TLS extension that tells the server which hostname the client wants, so one IP can host many sites.
What it is
server_name (extension 0), better known as Server Name Indication or SNI, is defined in RFC 6066. The client puts the hostname it wants to reach, for example example.com, into the ClientHello. This lets a server that hosts many sites on one IP address pick the right certificate before the encrypted part of the handshake begins.
Without SNI, the server has to guess which certificate to present, which in practice means one certificate per IP address. SNI is what makes shared hosting and CDNs work with HTTPS, and practically every client sends it today.
SNI is sent in the clear in TLS 1.2 and TLS 1.3, so anyone on the network path can see which site a client visits even though the content is encrypted. Network filters and firewalls use this to block or log sites. Encrypted Client Hello (ECH, RFC 9849) is the extension that hides it.
Who sends it
Measured on 2026-10-25 against our own test server: sent by 12 of 12 clients. Position counts from 1 and ignores GREASE values.
Why it matters for fingerprinting
All measured clients send SNI when they connect to a hostname, so its presence is not a signal, but its absence is: a client that connects by IP address or strips SNI stands out at once. JA4 records it in its prefix as d (domain) or i (IP, no SNI).
Its position varies: Go net/http and Debian curl send it first, Python requests and httpx second, while Chrome shuffles its extension order on every connection, so its position differs between visits. In our capture it was 9th.
Check whether your client sends it
Open the test from your browser, or call it from your script, and look for server_name in the TLS details.
Run the TLS fingerprint test