Zeep, SSL/TLS, and Server Name Indication

[Evan0000000000]

Broadly the path of TLS connection I'm trying to make looks like this:
Python 3.11 script -> VPN -> work intranet -> SSL appliance -> internet -> SOAP endpoint on Azure

What I expect then is a TLS connection gets me a certificate for the endpoint domain but self-signed by my employer from the SSL appliance. Given that, I have a .crt file on hand to verify the certificate..

What I'm seeing is this:

• Sometimes the above happens and zeep connects just fine
• Sometimes the certificate I get appears to be from the underlying Azure infrastructure and is not self signed; in this case Zeep (correctly) raises a Fault about being unable to verify the certificate

Doing some testing with Python and OpenSSL I can make those two things happen at will by enabling or disabling the SNI extension in TLS.

I don't understand though, why the result would vary when I'm using zeep -- put another way, since I'm not changing any settings I'd expect it to either always work or always fail,

That it should vary seems to imply either:

• That the Azure host can return an arbitrary selection from the certificates it has
• That the network infrastructure my employer uses is caching something and returning it to me erroneously

Would appreciate some more experienced input here, as this level of network connection stuff is very new to me.