Will website name in certificate shared by server during handshake kill the DNS over https purpose?

Question

While querying DNS over https lets assume the user gets ip over secure connection. In the handshaking process the website shares its certificate in plaintext which includes website name and other info. Will it kill the DNS over https purpose other than active sniffing?

Answer 1

There are actually two clear-text exposures in the TLS protocols used by HTTPS.

1. Server certificate – sent by server in ServerHello
2. Server Name Information (SNI) – sent by client in ClientHello

The latest version of TLS: 1.3, which is starting to be adopted by browsers and web server software, provides encryption for the ServerHello, and within a year or so, should be widely adopted, making the exposure of domain names in certificates much less likely.

SNI is more difficult to send in a secure encrypted form that is resistant to active attackers (protection against passive monitoring is more practical, but does not protect targeted clients). SNI is used by web hosting servers to determine which service's certificate should be used when there are multiple services sharing the same IP address.

While clear-text SNI information does weaken the privacy goals of DNS-over-HTTPS and the alternative DNS-over-TLS, there is a strong case to be made that encrypting and authenticating DNS requests and responses

• Protects against interception and modification, whether for censorship or malicious domain poisoning
• Blocks both passive and active monitoring of one part of your internet communications

Not all internet traffic is web, if you run a mail transfer agent, it needs to look up the domains of your e-mail recipients and even when it uses SMTP TLS SNI is not usually involved.

For web browsing, there are mechanisms that can be used by the operators of sensitive domains, such as Domain Fronting that can be used to make the exposure of SNI less revealing, by sending one domain in the SNI request, and another in the HTTP Host: header. There is even an Internet Draft proposal to supply the desired "fronting" SNI via DNS.

There are also several different Internet Draft proposals for protecting SNI: one uses both DNS records and TLS extensions and another uses tunneling to protect the SNI information. The author of the latter proposal has a more generally accessible blog post illustrating the difficulties of protecting SNI against all possible attacks.