[icebraining]

To connect to an HTTPS site without SNI, the IP can only host a single domain, so they can just block the whole (IP:443) combination without affecting any other site.

[cmircea]

What if the IP is dynamic? Say an Azure Cloud Service.

[mpyne]

I think the problem is that you'd need a different X.509 certificate for TLS, for each and every single IP.

[cmircea]

The certificate is issued for the domain, not the IP.