diff --git a/port/esp_tls_wolfssl.c b/port/esp_tls_wolfssl.c
index ed8127b..10711ab 100644
--- a/port/esp_tls_wolfssl.c
+++ b/port/esp_tls_wolfssl.c
@@ -364,6 +364,17 @@ static esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls
             return ESP_ERR_WOLFSSL_SSL_SET_HOSTNAME_FAILED;
         }
         free(use_host);
+    } else {
+        /* skip_common_name only disables hostname *verification* of the peer
+         * certificate; SNI must still be sent so the server presents the
+         * certificate for the requested host (e.g. virtual hosts / CDNs).
+         * See esp-idf PR #14684. */
+        if (hostname != NULL && hostlen > 0) {
+            if ((ret = wolfSSL_UseSNI(tls->priv_ssl, WOLFSSL_SNI_HOST_NAME, hostname, hostlen)) != WOLFSSL_SUCCESS) {
+                ESP_LOGE(TAG, "wolfSSL_UseSNI failed, returned %d", ret);
+                return ESP_ERR_WOLFSSL_SSL_SET_HOSTNAME_FAILED;
+            }
+        }
     }
 
     if (cfg->alpn_protos) {