A method at a relay service node to facilitate establishment of a secure connection between a first node within a restrictive access network, and a second node, the method comprising: accepting a control connection from the first node; following the accepting of the control connection and receiving a control message from the first node to request the relay service node to associate a fully qualified domain name with the first node, associating a fully qualified domain name with the first node, wherein the control message received at the relay service node provides the fully qualified domain name from the first node to the relay service node; accepting a second connection from the second node, and receiving, over the second connection, a message requesting secure connection establishment with the first node, the message requesting secure connection establishment also providing the fully qualified domain name, FQDN, for the first node, the message received over the second connection is a secure socket layer ClientHello message having a server name indication, SNI, with a value of the fully qualified domain name for the first node and wherein the relay service node extracts the FQDN for the first node from the server name indication field of the secure socket layer ClientHello message; in response to determining that the fully qualified domain name provided by the message requesting secure connection establishment matches to the first node, using the fully qualified domain name for the first node provided by the message requesting secure connection establishment with the first node and a transmission control protocol port allowed by the restrictive access network to reach the first node and establish a secure sockets layer/transport layer security, SSL/TLS, connection with the first node, the establishment comprising: sending, over the control connection, a connection attempt request to establish a third connection from the first node, the connection attempt request being associated with a unique connection identifier, UCI, that is assigned by the relay service node; accepting the third connection from the first node; binding the second connection with the third connection using the unique connection identifier, UCI; and forwarding the message requesting secure connection establishment with the first node to the first node; wherein the method provides a SSL/TLS handshake between the first node and the second node, and wherein SSL/TLS traffic between the first node and the second node is transparent to the relay service node, thus preserving end-to-end SSL/TLS security between the first node and the second node. accepting a control connection from the first node; following the accepting of the control connection and receiving a control message from the first node to request the relay service node to associate a fully qualified domain name with the first node, associating a fully qualified domain name with the first node, wherein the control message received at the relay service node provides the fully qualified domain name from the first node to the relay service node; accepting a second connection from the second node, and receiving, over the second connection, a message requesting secure connection establishment with the first node, the message requesting secure connection establishment also providing the fully qualified domain name, FQDN, for the first node, the message received over the second connection is a secure socket layer ClientHello message having a server name indication, SNI, with a value of the fully qualified domain name for the first node and wherein the relay service node extracts the FQDN for the first node from the server name indication field of the secure socket layer ClientHello message; in response to determining that the fully qualified domain name provided by the message requesting secure connection establishment matches to the first node, using the fully qualified domain name for the first node provided by the message requesting secure connection establishment with the first node and a transmission control protocol port allowed by the restrictive access network to reach the first node and establish a secure sockets layer/transport layer security, SSL/TLS, connection with the first node, the establishment comprising: sending, over the control connection, a connection attempt request to establish a third connection from the first node, the connection attempt request being associated with a unique connection identifier, UCI, that is assigned by the relay service node; accepting the third connection from the first node; binding the second connection with the third connection using the unique connection identifier, UCI; and sending, over the control connection, a connection attempt request to establish a third connection from the first node, the connection attempt request being associated with a unique connection identifier, UCI, that is assigned by the relay service node; accepting the third connection from the first node; binding the second connection with the third connection using the unique connection identifier, UCI; and forwarding the message requesting secure connection establishment with the first node to the first node;