§ 01
Definition
SNI is defined in RFC 6066. Without it, every HTTPS site would need its own IP address. With it, the server knows which certificate to present before encryption begins.
§ 02
How it works
The hostname is sent in the Client Hello message. Unless Encrypted Client Hello is used, that name is visible to anyone on the path: your ISP, your employer, a public Wi-Fi operator. Censorship systems often block sites by matching the SNI field.
§ 03
Why it matters
SNI is why HTTPS hides what you do on a site but not which site you visit. A VPN moves that visibility from your local network to the VPN server; ECH aims to remove it for supported sites.