perform checks without SNI first, then with SNI