diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b559e38a5..342f53c55d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ### Enhancements
 - Support nested JWT claims in role DLS queries ([#5687](https://github.com/opensearch-project/security/issues/5687))
+- Support creation of client SSL engine with a given SNI ([#5894](https://github.com/opensearch-project/security/pull/5894))
+
 ### Bug Fixes
 - Fix IllegalArgumentException when resolved indices are empty in PrivilegesEvaluator ([#5770](https://github.com/opensearch-project/security/pull/5797))
 - Fixes an issue where recursive LDAP role search would fail with a NullPointerException ([#5861](https://github.com/opensearch-project/security/pull/5861))
diff --git a/src/main/java/org/opensearch/security/ssl/OpenSearchSecureSettingsFactory.java b/src/main/java/org/opensearch/security/ssl/OpenSearchSecureSettingsFactory.java
index 7c45d2ca26..6e2ea7544f 100644
--- a/src/main/java/org/opensearch/security/ssl/OpenSearchSecureSettingsFactory.java
+++ b/src/main/java/org/opensearch/security/ssl/OpenSearchSecureSettingsFactory.java
@@ -128,7 +128,14 @@ public Optional<SSLEngine> buildSecureServerTransportEngine(Settings settings, T
 
             @Override
             public Optional<SSLEngine> buildSecureClientTransportEngine(Settings settings, String hostname, int port) throws SSLException {
-                return sslSettingsManager.sslContextHandler(CertType.TRANSPORT_CLIENT).map(c -> c.createClientSSLEngine(hostname, port));
+                return this.buildSecureClientTransportEngine(settings, null, hostname, port);
+            }
+
+            @Override
+            public Optional<SSLEngine> buildSecureClientTransportEngine(Settings settings, String serverName, String hostname, int port)
+                throws SSLException {
+                return sslSettingsManager.sslContextHandler(CertType.TRANSPORT_CLIENT)
+                    .map(c -> c.createClientSSLEngine(hostname, port, serverName));
             }
         });
     }
diff --git a/src/main/java/org/opensearch/security/ssl/SslContextHandler.java b/src/main/java/org/opensearch/security/ssl/SslContextHandler.java
index 147223bf3f..f65ec598ba 100644
--- a/src/main/java/org/opensearch/security/ssl/SslContextHandler.java
+++ b/src/main/java/org/opensearch/security/ssl/SslContextHandler.java
@@ -19,6 +19,7 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
+import javax.net.ssl.SNIHostName;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLEngine;
 import javax.net.ssl.SSLParameters;
@@ -62,10 +63,22 @@ public SSLEngine createSSLEngine() {
      * Creates a SSL engine for usage as a client. In this case, we can optionally perform hostname verification.
      */
     public SSLEngine createClientSSLEngine(final String hostname, final int port) {
+        return createClientSSLEngine(hostname, port, null);
+    }
+
+    /**
+     * Creates a SSL engine for usage as a client with a specified Server Name Indication (SNI).
+     */
+    public SSLEngine createClientSSLEngine(final String hostname, final int port, final String serverName) {
         SSLEngine sslEngine = sslContext.newEngine(NettyAllocator.getAllocator(), hostname, port);
-        if (hostname != null) {
+        if (hostname != null || serverName != null) {
             SSLParameters sslParams = new SSLParameters();
-            sslParams.setEndpointIdentificationAlgorithm("HTTPS");
+            if (hostname != null) {
+                sslParams.setEndpointIdentificationAlgorithm("HTTPS");
+            }
+            if (serverName != null) {
+                sslParams.setServerNames(List.of(new SNIHostName(serverName)));
+            }
             sslEngine.setSSLParameters(sslParams);
         }
         return sslEngine;