SNI

What if instead of trying to do a different profile, I used the existing profile/VIP and wrote a policy to reset traffic if a certain protocol is used for a certain server name? Basically:

Match all the following conditions
SSL Extension server name is abc.domain.com at ssl client hello
client ssl protocol is SSLv3 at request time
Do the following:
Reset traffic

So if a request comes in for abc.domain.com attempting with SSLv3, reset it. All other hosts would be allowed. Thoughts?

Edit: I might have to use HTTP Host instead if the protocol does not support SNI.

Edit 2: I did test this and it does reset the connection once there is a GET request. It does however still show up in an SSL Scan as expected.