I don&#x27;t think this is possible. I can have different TLS configs for each vhost I set up on a single HTTP instance. And until the SNI is sent the server has no way of knowing which vhost to use.<p>Also SNI needs to match the hostname specified in the X.509 part of the cert. Certs are issued based on DNS names which need to correspond to SNI.<p>I&#x27;m not sure how much hiding the SNI would get you in terms of privacy. You could always just look at the destination IP address of the packet.