> Actually, you could proxy based on SNI alone
If you assume the origin speaks TLS and holds the cert/private key, and isn't using ESNI/ECH, then I suppose in a limited way it's possible. But...
> because they want to intercept all your traffic so the NSA gets a copy.
I don't believe that is the reason. I believe it's for features.
You need actual TLS termination to do most things CDNs and reverse proxies offer, such as:
- caching and compression
- WAF / bot detection
- URL-based routing
- header manipulation and redirects
- application-layer DDoS filtering
- analytics
- edge functions and content transformation
If you assume the origin speaks TLS and holds the cert/private key, and isn't using ESNI/ECH, then I suppose in a limited way it's possible. But...
> because they want to intercept all your traffic so the NSA gets a copy.
I don't believe that is the reason. I believe it's for features.
You need actual TLS termination to do most things CDNs and reverse proxies offer, such as:
- caching and compression
- WAF / bot detection
- URL-based routing
- header manipulation and redirects
- application-layer DDoS filtering
- analytics
- edge functions and content transformation