NSE HTTP requests with option any_af result in TLS requests that populate SNI with an address, instead of the hostname. Example code:

http.get("foo.bar.com", 443, "/", {any_af=true})

The reason is that the hostname gets replaced with an address in function request (a local function in http.lua), losing the original name:

  if type(host) == "string" and options.any_af then
    local status, addrs = nmap.resolve(host)
    host = addrs[1] or host
  end

Subsequent code then unsurprisingly populates SNI with the new host value.

The following patch seems to resolve the issue by converting the host string into a table and preserving the original name as targetname:

--- a/nselib/http.lua
+++ b/nselib/http.lua
@@ -1194,7 +1194,9 @@
 
   if type(host) == "string" and options.any_af then
     local status, addrs = nmap.resolve(host)
-    host = addrs[1] or host
+    if status then
+      host = {ip = addrs[1], targetname = host}
+    end
   end
 
   local socket, partial, opts = comm.tryssl(host, port, data, { timeout = optio

Please let me know if you see any issues with the patch or you believe that the problem should be resolved differently. Otherwise I will commit the patch in a few weeks.