Determining and Enforcing Data Location of Internet Traffic Routing Using Transport Layer Security (TLS) Server Name Indication (SNI)

A non-transitory machine-readable storage medium that provides instructions that, if executed by a processing system of a first server of a plurality of servers of a distributed cloud computing network, will cause said first server to perform operations comprising:

• receiving a secure session request as part of a secure session handshake, wherein the secure session request includes a Server Name Indication (SNI) field, and wherein the secure session request originates from a client network application;
• determining a hostname from the SNI field;
• determining that a policy is applicable for the determined hostname, wherein the determined policy indicates a first location where decrypting and servicing traffic for the determined hostname is permitted;
• determining that a second location of the first server does not satisfy the determined policy;
• proxying the secure session handshake between the client network application and a second server of the distributed cloud computing network that satisfies the determined policy, wherein a successful secure session handshake creates a secure session between the client network application and the second server;
• and
• proxying layer 4 traffic transmitted over the secure session between the client network application and the second server.

A first server of a plurality of servers of a distributed cloud computing network, the first server comprising:

• a processing system;
• and
• a non-transitory machine-readable storage medium that provides instructions that, if executed by the processing system, will cause said first server to perform operations including:
• receiving a secure session request as part of a secure session handshake, wherein the secure session request includes a Server Name Indication (SNI) field, and wherein the secure session request originates from a client network application,
• determining a hostname from the SNI field,
• determining that a policy is applicable for the determined hostname, wherein the determined policy indicates a first location where decrypting and servicing traffic for the determined hostname is permitted,
• determining that a second location of the first server does not satisfy the determined policy,
• proxying the secure session handshake between the client network application and a second server of the distributed cloud computing network that satisfies the determined policy, wherein a successful secure session handshake creates a secure session between the client network application and the second server, and
• proxying layer 4 traffic transmitted over the secure session between the client network application and the second server.