Discuss proper test helper for sni_blocking

[bassosimone]

It seems using ps.ooni.io is not wise because we may be blocked automatically. We need instead to come up with a better solution for deploying a test helper here.

[bassosimone]

Changed this as a "discuss" thing that is a good to discuss in the ~10 Feb week. The original issue was "L" but actually starting to have a conversation on that is a small thing we can easily do.

[bassosimone]

cc: @fortuna

[fortuna]

The test helper could be cloudflare.com, or example.com. Or some other service that is well provisioned. We can do fallback and only use third-party domains is OONI's is blocked.

The requirement is that they should be TLS services that can be accessed from the client's network and return predictable results.

With both domains, I get a ServerHello with a certificate that is not valid for the test domain, with exceptions:

• For cloudflare.com, if the test domain is on Cloudflare, then I get a valid certificate. You can differentiate from MITM by checking the CA chain.
• For example.com, you will get a valid certificate for all variations of the example.com domain (www.example.com, example.net, ...)

The trick is to always check the validity of the certificate, with a valid certificate indicating that SNI is not being blocked.

[bassosimone]

After discussing this issue with @fortuna, @hellais, and @FedericoCeratto, we concluded that for the time being we're using example.com. I'll add this as the todo list in #309