Can't update system/bundled plugins when JVM flag "-Djsse.enableSNIExtension=false" is used

Summary

• JVM "-Djsse.enableSNIExtension=false" parameter was added in setenv.shas a workaround to error 'handshake alert: unrecognized_name' when setting up application links after upgrading Confluence. Permanent resolution can't be applied because of apache/oracle limitations
• Then it is not possible to update any system or user plugins via Confluence Administration -> Manage add-ons.
  This was working fine till September, when changes happened on Marketplace side

Instance Details

• Problem reproducible on instances 5.10, 6.4.3, 6.1, databases psotgreSQL 9.4 and H2, bundled Java 8

How to Replicate

• Install Confluence 6.4.3 (linux 64 bit) using default installation parameters and H2 database.
• Download directly from marketplace any 3rd party plugin .jar file (use one or two versions below the most recent so that update option is possible)
• Upload plugin manually by going to Confluence Administration -> manage add ons -> Upload add-on
• Shutdown Confluence. Add following parameter to setenv.sh file

  CATALINA_OPTS="-Djsse.enableSNIExtension=false ${CATALINA_OPTS}"  
  

• Start Confluence, go to COnfluence Administration -> Manage add-ons. Try to update 3rd party plugin installed previously.
  Update will not be possible, following message should be visible in application logs

 2017-10-10 08:59:16,876 ERROR [UpmAsynchronousTaskManager:thread-3] [rest.resources.install.InstallFromUriTask] download Error downloading plugin from https://marketplace.atlassian.com/download/plugins/com.gliffy.integration.confluence/version/1004028 -- url: /rest/plugins/1.0/ | referer: https://eshare.advantest.com/plugins/servlet/upm | traceId

Workaround

• Remove the JVM Parameter "-Djsse.enableSNIExtension=false"
• Add the correct ServerName/ServerAlias(ses) to the specific hosts in the Apache configuration as this article describes: https://community.qualys.com/thread/13532