Interesting point solution. Do you just license through the AWS Marketplace? Any issues with encrypted SNI?
ESNI (now Encrypted Client Hello: https://tools.ietf.org/html/draft-ietf-tls-esni-08) is still in draft.
v1 of the firewall that is currently published ignores the extension but will deny in case SNI is absent.
v2, due in a couple of weeks, will actively seek presence of any of ECH extensions and deny them. This is to prevent domain-fronting style of exfiltration attempts. We expect HTTP Clients in the enterprise to not have moved over to ECH any time soon. However, the firewall has a lot of checks and balances built-in to mitigate this in the future when it arrives.
Should you be interested in the v2 preview, drop us an email (from your work email) or follow our LinkedIn page.
Regarding V1 of your product that ignores the encrypted SNI (ESNI) extension, do you mean it just allows all traffic using ESNI? If so, have you considered blocking malicious domains via DNS instead?
Happy to invite you to the v2 preview if you drop us an email (from your work email) or follow our LinkedIn page.