title: Unable to properly utilize client-side SNI across my system
body: <p>This question is closely related to my other question: <a href="https://stackoverflow.com/questions/65912428/">Python `urllib3`: sudden &quot;certificate verify failed: certificate has expired&quot; error</a>.</p>
  <p>For some reason it seems like my attempts at provide the correct hostname for SNI do not succeed. This manifested first in the proxy in the linked question, as without properly working SNI it can't successfully validate certificates. Then as I went onto debugging the issue using an installation of OpenSSL (separate from Python and the system) it also displays the same signs. I decided to see if at least Node.js correctly works with SNI using this script, but no luck:</p>
  <pre class="lang-js prettyprint-override"><code>fs = require('fs/promises');
  tls = require('tls');
  
  const [,, host, port, file] = process.argv;
  const socket = tls.connect({
      host, port,
      servername: host,
      rejectUnauthorized: false,
  }, async () =&gt; {
      const cert = socket.getPeerCertificate(false);
      result = tls.checkServerIdentity(host, cert) ? 'No.' : 'Yes.';
      console.log('Valid for', cert.subjectaltname + '?', result);
      //await fs.writeFile(file, cert.raw)
      socket.destroy()
  });
  </code></pre>
  <p>I think this output does a good job showcasing the issue:</p>
  <pre><code>&gt; node .\sni-helper.js i.stack.imgur.com 443 test.tmp
  Valid for DNS:*.imgur.com, DNS:imgur.com? No.
  </code></pre>
  <p>A dozen of other hostnames likewise do not seem to be properly reflected in the provided certificates.</p>
  <p>My configuration:</p>
  <ul>
  <li>Windows 10 x64 fully up to date as of writing this.</li>
  <li>Python 3.9.1.</li>
  <li>Node.js v15.5.1.</li>
  <li>OpenSSL 1.1.1i 8 Dec 2020.</li>
  </ul>
  <p>Did anybody else have this problem? I have no idea where to go with this, other than maybe filing an issue in the OpenSSL repo, but I may simply failed at correctly setting my clients up overlooking something blatantly obvious, so I'd like to check with you guys first.</p>