Sni validation for Fastly

[the0R0ss]

Hello,
As you all know, Fastly has removed domain fronting, but we can still use any arbitrary SNI with 'allow insecure' activated to establish an SSL connection on Fastly. However, using 'allow insecure' is not safe. So, I checked and found that Fastly provides a default SSL if our SNI is not valid, with the value 'default.ssl.fastly.net'.
I would like to suggest that instead of having only two options, true and false, for the allowInsecure option, a third option, "default.ssl.fastly.net", should be added. This way, we can use any arbitrary SNI to trick GFW while still validating the public key using the given value. The third option could be more generalized. Instead of always using 'default.ssl.fastly.net', we should allow users to specify a desired value, which may help in situations beyond Fastly CDN.

[the0R0ss]

I started this conversation on another forum, and someone responded as follows:

[response]

I don’t have any technical knowledge, but if it can be implemented in the core, that would be great.