Can one passively load-balance HTTPS traffic based on TLS SNI? Is it theoretically possible to passively snoop into the HTTPS traffic, reliably detect whether or not TLS SNI is attempted to be used by the client, and, if it is, redirect the stream of the connection as-is to one of the many different upstreams (each one of which requires HTTPS in order to connect and may have its own certificate not necessarily known to us)?
The SNI extension is plain text in the ClientHello. This means that it is possible to passively snoop the value and redirect the traffic. This is already used in practice, i.e. haproxy has this feature for several years.