What is Server Name Indication in SSL?

0-2 years experience

1. 1You need to host two different HTTPS websites on the same EC2 instance. How would you configure the server so each domain receives its own certificate?
2. 2If a client connects to your EC2 instance without sending SNI, what does the TLS handshake do and which certificate is presented?

2-5 years experience

1. 1We added a new domain to our existing load balancer on EC2, but browsers still show the default certificate. Walk me through how you’d debug this SNI issue.
2. 2Explain the trade‑offs between terminating TLS at the EC2 instance versus at an Elastic Load Balancer when you need SNI for multiple domains.
3. 3During a rollout, some clients started receiving certificate‑mismatch errors. How would you determine if SNI is the root cause?

5-8 years experience

1. 1Design a solution to serve hundreds of customer‑specific subdomains over HTTPS on a fleet of EC2 instances, ensuring each gets its own certificate with minimal latency.
2. 2What are the performance and security implications of using SNI with older clients that don’t support it, and how would you mitigate those in production?
3. 3How would you implement automated certificate rotation for SNI‑enabled services on EC2 without causing downtime?

8+ years experience

1. 1Our team is migrating from a monolithic EC2‑based app to a microservices architecture with multiple load balancers. How would you evolve the SNI strategy to support zero‑downtime migrations and cross‑team ownership?
2. 2Discuss the long‑term maintenance challenges of managing thousands of SNI certificates across AWS regions, and propose an architecture that balances cost, security, and operational overhead.
3. 3If a regulatory requirement forces us to support TLS 1.0 for legacy clients, how would you reconcile that with SNI usage and what architectural changes would you recommend?