Hacker News Reader

To connect to an HTTPS site without SNI, the IP can only host a single domain, so they can just block the whole (IP:443) combination without affecting any other site.

View on HN

What if the IP is dynamic? Say an Azure Cloud Service.

I think the problem is that you'd need a different X.509 certificate for TLS, for each and every single IP.

The certificate is issued for the domain, not the IP.

Reply on news.ycombinator.com