&gt; IP and port are required for routing, and as such aren&#x27;t protected.<p>&gt; The hostname is (usually) exposed through DNS, and is required for the server to know which certificate to send.<p>SNI solves this problem.<p>&gt; Also, usually (almost) everything is exposed on the first request, before the server has got the chance to redirect to the encrypted version. At that point, the ISP&#x2F;interceptor could just replace the redirect...<p>Admittedly, this is somewhat of a culture issue. I haven&#x27;t read the DNSSEC spec, but it&#x27;d be cool to be able to specify redirects using DNS or smth. But at the end of the day, after that first connection (or preferably, it&#x27;s already setup with HSTS preinitialized in your browser) you&#x27;re never not going to be using HTTPS without scary warnings (assume the site admin has set up TLS properly).