TLS_SNIHostname enables the TLS Server Name Indication (SNI) with the specified hostname at the start of the TLS handshake. Defaults to not set and no SNI is sent. Special formatting characters are supported. TLS_SNIHostname is intended for use by TLS clients, such as <AuthBy RADSEC>.

When the parameter is set to an empty value, SNI is not enabled. This can be useful with <AuthBy RADSEC> to suppress SNI for a <Host ...> clause while allowing the other clauses to use the default SNI.

TLS_SNIHostname radsec.example.com