This still doesn't look quite right to me.

Correct me if I'm wrong but I see lib/_tls_wrap calling the TLSSsocket constructor with `{ SNICallback: self.SNICallback }` so there's always an SNICallback, right?

If that's the case, can't you replace `(options.SNICallback !== SNICallback || options.server._contexts.length)` with just `options.server._contexts.length > 0`?

Then maybe add a `assert(typeof options.SNICallback === 'function')` check, just in case.