@SeanWrightSec Ahhh, hang on, the answer may be in the title. You said when you tested with s_client you had to use -servername to get the right certificate. The title suggests requests doesn't set the SNI name correctly/at all. Let me test that