The SNI (Server Name Indication) Whitelist is a security feature of Edge Security Accelerator (ESA). When enabled, it directs ESA to verify consistency between the SNI in the SSL/TLS handshake and the HOST header in the HTTP request. Requests with mismatched values are rejected. You can configure a whitelist of domains that skip this verification to prevent domain misuse and mitigate Domain Fronting attacks.
Overview
The SNI Whitelist feature allows ESA security administrators to enforce SNI-HOST consistency for HTTPS requests. When the feature is active, ESA compares the SNI value provided during the TLS handshake with the HOST header in the HTTP request. If the two values do not match and the domain is not on the whitelist, the request is rejected.
Background information
Domain Fronting exploits the inconsistency between the SNI field and the HOST header in an HTTPS connection to conceal the actual destination domain. Attackers use this technique to bypass network restrictions or carry out malicious activities.
After you enable the SNI Whitelist, ESA enforces consistency verification between SNI and HOST for all requests. Only domains explicitly added to the whitelist bypass this check, effectively blocking Domain Fronting attack vectors.
Configure the SNI Whitelist
In the ESA console, go to Websites. In the Website column, click your target site.
In the navigation pane on the left, choose .
Click Configure in the upper-right corner of the SNI Whitelist section to enter edit mode.
Set the Status switch to On.
In the Whitelist input field, enter the domains that should skip the SNI-HOST consistency check.
You can enter a site prefix (for example,
www), and the system automatically completes it to a full domain name (for example,www.example.com).
Click OK to save the configuration. The configuration takes effect within a few minutes.
Configuration parameters
Parameter | Description |
Status | Controls whether the SNI Whitelist feature is active. When active (On), ESA performs consistency verification between SNI and HOST for non-whitelisted domains; requests that fail the check are rejected. When inactive (Off), no consistency verification is performed. |
Whitelist | A list of domains that skip the SNI-HOST consistency check. Whitelisted domains bypass verification during requests. Domains must match the current site. Up to 50 domains are supported. Domains containing |