Re: [LINK] Calling time on DNSSEC?

On Tue, 3 Dec 2024 22:51:00 -0600, Grant Taylor wrote:

On 12/3/24 20:02, Lawrence D'Oliveiro wrote:
>

That requires a separate protocol on top of TLS.

 
My understanding is that ESNI is part of TLS.

It can’t be. TLS cannot start encryption on HTTP until it gets a cert that
identifies the server. That cert depends on the domain name. Which comes
from the “Host:” header line from the client. Which is why that cannot be
sent encrypted.