nx_sni_cert_select.nx

nx_sni_cert_select.nx -- SNI -> per-domain wildcard-cert SELECTION for the SNI-aware sovereign TLS site daemon (Route B). The SNI host_name is CLEARTEXT in the first ClientHello record (RFC 6066), so the daemon can peek it BEFORE terminating TLS and decide WHICH loaded wildcard chain+key pair to present: index 0 = NISHI (*.nishifamily.com + nishifamily.com) <- the DEFAULT index 1 = ANDELIN (*.andelinwest.com + andelinwest.com) Matching is LABEL-AWARE and case-insensitive (DNS labels are case-insensitive): a host matches a domain iff it EQUALS the domain (registrable apex) OR ends with ".<domain>" (a real sub-label) -- so "app.nishifamily.com" matches but the look-alike "evilnishifamily.com" does NOT (it falls to the default instead of being mis-selected). FAIL-SAFE BY CONSTRUCTION (rule 12 + rule 14): a missing / empty / malformed / unknown SNI returns the DEFAULT index, never an error and never a crash. This function only CHOOSES which already-validated cert to present; it AUTHORIZES nothing -- a client that sends a bogus SNI simply gets the default cert and fails validation on ITS side. Composes the proven, bounds-checked sni_extract_hostname parser (nx_sni_extract.nx, the same organ nx_sni_router peeks with) -- it does NOT add a second ClientHello parser (rule 15 DRY). Pure decision logic so both the daemon AND the gate share ONE codepath. license_tier: ORIGINAL