Challenge 2: Why Multi-Domain HTTPS on One IP Needed SNI —
Solution Walkthrough

Why it was impossible before SNI:

A TLS handshake -- negotiating encryption and the server presenting
its certificate -- has to happen before any HTTP request data,
including the Host header, is ever sent. That's a hard ordering
requirement: the request itself needs to be encrypted using whatever
the handshake just negotiated, so it can't be sent first. This
created a real chicken-and-egg problem for a server hosting multiple
HTTPS domains, each needing a different certificate, on a single IP:
the one piece of information that would say which certificate to
present -- the Host header -- physically couldn't arrive until after
the certificate had already been presented. Without any other way to
know which site was intended, the server's only real option was to
key the decision off something available earlier: which specific IP
address the connection came in on, which meant one dedicated IP per
HTTPS domain.

What SNI adds, and when:

SNI is a TLS extension that adds the target hostname directly into
the ClientHello message -- the very first message of the handshake,
sent in plain text before encryption is established. That's early
enough to solve the problem: the server now has the hostname before
it needs to pick a certificate, so it can select the correct
VirtualHost (and therefore the correct certificate) for that specific
domain before the rest of the handshake proceeds. The Host header
still arrives later, encrypted, inside the actual HTTP request -- SNI
doesn't replace it, it just provides the same information early
enough, in the one place (the TLS handshake itself) where it's
actually needed.

WHY THIS WORKS AS AN ANSWER
------------------------------
This exercise checks that the reader understands the precise ordering
problem SNI solves -- not just that it "helps with HTTPS," but
specifically that it moves the hostname information earlier than the
encrypted Host header, into the one place in the handshake sequence
where the server actually needs it to pick a certificate.