Support for fully transparent proxying including man-in-the-middle on TLS connections
Clients do need to send the SNI header which modern clients do these days