How to enable encrypted sni from cloudflare cdn to source server

[username123]

What is the name of the domain?

api.crackme.net

What is the issue you’re encountering

cloudflare cdn to source server not enabled encryption sni

Was the site working with SSL prior to adding it to Cloudflare?

Yes

What is the current SSL/TLS setting?

Full (strict)

What are the steps to reproduce the issue?

As shown in the figure, 172.69.33.170 is the cdn server of cloudflare, when requesting the source server sni is transmitted in plaintext, how to enable encrypted sni

Screenshot of the error

[sjr]

I don’t know if Cloudflare does ESNI to the origin, I guess not - there’s no specific option to require it. It would likely need TLSv1.3 and support at your origin.

Instead use a Cloudflare tunnel to pass all the data between Cloudflare and your origin.

Cloudflare Tunnel · Cloudflare Zero Trust docs

[mikegmcd]

I wonder if Encrypted Client Hello would do the trick. (Good-bye ESNI, hello ECH!).

It is available under SSL/TLS → Edge Settings → Encrypted Client Hello.

[sjr]

@mikegmcd

I wonder if Encrypted Client Hello would do the trick.

ECH works between the client and the Cloudflare edge (in place of ESNI which seems to have some issues), the OP wants to hide the SNI between Cloudflare and the origin which I don’t think is yet available (other than using a tunnel).