When connecting to a proxy server, the first message is CONNECT:
CONNECT server.example.com:80 HTTP/1.1
Host: server.example.com:80
If I understand correctly, the Host field, in the first row and the second row can be different. The host in the first row indicates which server you are actually connecting to. In the case of proxy forwarding, it may be different.
The host in the second row indicates which site we requested.
In that case, is the SNI required? And if so can they be different?
If I understand correctly, the Host field, in the first row and the second row can be different.
The Host header has no meaning for proxy requests. It is only relevant for the final server. The Host header of a CONNECT request will not be send to the final destination anyway - nothing from the CONNECT request will.
In that case, is the SNI required? And if so can they be different?
As a result of the CONNECT request a tunnel between client and the requested final server is established. The final server will only see anything from this tunnel. Since SNI is needed by the server to select the certificate it is also needed when HTTPS is send over a proxy - otherwise the server would not know which certificate to select.