What about SNI? Don't most clients advertise the hostname via SNI outside of the TLS envelope? It maps to tls-host in Mikrotik, doesn't it? Is there a way to monitor that?