Hacker News Reader

I found this quick read describing domain fronting interesting: http://blog.attackzero.net/2015/11/domain-fronting-and-you.h...

This article on [domain fronting][0] is very informative, though also quite long.

Surely the real domain name of the service will appear in the server certificate?

The server returns the certificate of the name given in the SNI, which is the fronted domain, not the real one.