SNI is the &quot;server_name&quot; extension in the ClientHello message, which is not encrypted. So no, looks like there are no changes to this in TLS 1.3.<p>Theoretically it could be possible to encrypt it (using DHE) before server validation occurs (i.e. before the server&#x27;s RSA certificate is needed).  However, it would rigorously change the protocol and I can imagine it would make some load balancing applications a lot more complicated as well.