On Mon, May 9, 2016 at 3:30 PM, Radim Vansa <rvansa@redhat.com> wrote:

So you can initiate connection with SSL (+SNI) and then downgrade it to
plain-text?

No, that's not possible. SNI Host Name is used to match proper certificate from KeyStore. After successful handshake, you communicate further with SSL/TLS.