[codedokode]

In TLS 1.3 server certs are encrypted. And while browsers support ECH (Encrypted Client Hello) to encrypt SNI, almost no server supports it. Cloudflare has ECH disabled globally for some "issues" they do not disclose [1].

[1] https://developers.cloudflare.com/ssl/edge-certificates/ech/