ssl uses peek and splice method to query clients sni and this info can make a cert - purportedly...not to be confused for the bump list where you put the sensitive domains you don't want to decrypt their headers, they get on bumplist#ssl bump