rewriting client ssl server name

Hi Craig,

the SSL-negotiation MUST be completed before the client sends its first HTTP request. So there is really no way, to inspect, change or even redirect the HTTP request before the certificate error message appears. This is a core security mechanism of HTTPS to avoid Man-in-the-Middle attacks and can't be turned of (and shouldn't!).

Although SNI (Server Name Indication) may send the certificate subject to the server during a SSL-handshake. But even SNI can't be abused to redirect the client. It would be too dangerous...

Cheers, Kai