Dynamic Per-Connection Certificates for QUIC in Envoy

Hi all,

I’m exploring a setup where Envoy should present different TLS certificates on a per-QUIC-connection basis, depending on the SNI. Because some clients use ECH, the inner SNI may be encrypted, id like to instead infer the intended SNI from dynamic metadata we set at the listener filter.

A couple of questions:

Is there a recommended approach for selecting certificates dynamically for QUIC based on per-connection metadata (rather than the SNI visible to Envoy)?

Is there any experimental support or planned API to give the QUIC handshake access to FilterState, dynamic metadata, or similar Conn-level information during certificate selection?

Any guidance, design pointers, or examples would be greatly appreciated. Thanks!