SSL Bump differences at various steps
Andrey K <[email protected]> Fri, 6 Mar 2026 12:35:13 +0300
| Newsgroups | gmane.comp.web.squid.general |
|---|---|
| Message-ID | <CADJd0Y2NTfHV3=xTmZo6-szzoOEhROWhnhUsGY0k2KmcSbWqYw@mail.gmail.com> |
--===============3870142095813979138==
Content-Type: multipart/alternative; boundary="000000000000c689c1064c57c57e"
--000000000000c689c1064c57c57e
Content-Type: text/plain; charset="UTF-8"
Hello,
I was wondering what are the differences if we apply the ssl bump operation
at different steps?
The documentation contains information about only one difference - when we
bump at the step1 Proxy first establishes a TLS connection with the Client,
and then with the Server, while in the other cases - first with the Server,
and then with the Client.
I looked into this issue and tried to summarize the information I have (I
will not detail here the information available to the admin at each of the
three steps). Maybe it will help someone.
*1. step1*
Conf:
ssl_bump bump step1
Workflow:
step 1 (bump)
1. Client -> CONNECT aaa.bbb.ccc.ddd -> Proxy
2. Proxy -> HTTP 200 Connection established -> Client
3. Client -> Client Hello (SNI) -> Proxy
4. Proxy -> Makes Server Hello (with fake certificate for the SNI host) ->
Client
5. Client <- Complete TLS handshake -> Proxy
6. Proxy -> Makes Client Hello (based on the Client Hello SNI, but uses its
own cipher suites and TLS version) -> Server
7. Server -> Server Hello -> Proxy
8. Proxy <- Complete TLS handshake -> Server
9. Client -> HTTP Request -> Proxy
10. Proxy -> HTTP Request -> Server
11. Server -> HTTP Response -> Proxy
12. Proxy -> HTTP Response -> Client
...
*2. step2*
Conf:
ssl_bump stare step1
ssl_bump bump step2
Workflow:
step 1 (stare)
1. Client -> CONNECT aaa.bbb.ccc.ddd -> Proxy
2. Proxy -> HTTP 200 Connection established -> Client
step 2 (bump)
3. Client -> Client Hello (SNI) -> Proxy
4. Proxy -> Makes Client Hello (based on the Client Hello SNI, but *uses
its own cipher suites* and TLS version) -> Server
5. Server -> Server Hello -> Proxy
6. Proxy <- Complete TLS handshake -> Server
7. Proxy -> Makes Server Hello (with fake certificate for the SNI host with
mimicked attributes) -> Client
8. Client <- Complete TLS handshake -> Proxy
9. Client -> HTTP Request -> Proxy
10. Proxy -> HTTP Request -> Server
11. Server -> HTTP Response -> Proxy
12. Proxy -> HTTP Response -> Client
...
*3. step3*
Conf:
ssl_bump stare step1
ssl_bump stare step2
ssl_bump bump step3
Workflow:
step 1 (stare)
1. Client -> CONNECT aaa.bbb.ccc.ddd -> Proxy
2. Proxy -> HTTP 200 Connection established -> Client
step 2 (stare)
3. Client -> Client Hello (SNI) -> Proxy
step 3 (bump)
4. Proxy -> Makes Client Hello (based on the real Client Hello SNI, and
uses *Client's cipher suites* but its own TLS version) -> Server
5. Server -> Server Hello -> Proxy
6. Proxy <- Complete TLS handshake -> Server
7. Proxy -> Makes Server Hello (with fake certificate for the SNI host with
mimicked attributes) -> Client
8. Client <- Complete TLS handshake -> Proxy
9. Client -> HTTP Request -> Proxy
10. Proxy -> HTTP Request -> Server
11. Server -> HTTP Response -> Proxy
12. Proxy -> HTTP Response -> Client
...
We obtained these data by analyzing network dumps for each configuration.
Bumping at steps 2 and 3 are very similar, but in the first case, Proxy
sends Client Hello to a Server with its own ciphers, and in the latter case
- with ciphers received from the Client.
If anyone has any comments or additions, please feel free to complete it.
Kind regards,
Ankor.
--000000000000c689c1064c57c57e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr">Hello,<div><br></div><div><span class=3D"gmail-YPkS7KbdpWf=
GdYKd3QB9" style=3D"white-space-collapse: preserve;">I</span><span style=3D=
"white-space-collapse: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfG=
dYKd3QB9" style=3D"white-space-collapse: preserve;">was</span><span style=
=3D"white-space-collapse: preserve;"> </span><span class=3D"gmail-YPkS7Kbdp=
WfGdYKd3QB9" style=3D"white-space-collapse: preserve;">wondering</span><spa=
n style=3D"white-space-collapse: preserve;"> </span><span class=3D"gmail-YP=
kS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">what</span><s=
pan style=3D"white-space-collapse: preserve;"> are the </span><span class=
=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">d=
ifferences</span><span style=3D"white-space-collapse: preserve;"> if we app=
ly the </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-spa=
ce-collapse: preserve;">ssl</span><span style=3D"white-space-collapse: pres=
erve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-sp=
ace-collapse: preserve;">bump operation</span><span style=3D"white-space-co=
llapse: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=
=3D"white-space-collapse: preserve;">at</span><span style=3D"white-space-co=
llapse: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=
=3D"white-space-collapse: preserve;">different</span><span style=3D"white-s=
pace-collapse: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9=
" style=3D"white-space-collapse: preserve;">steps</span><span class=3D"gmai=
l-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">?</span><=
/div><div><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-c=
ollapse: preserve;">
<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">The</span> <span class=3D"gmail-=
YPkS7KbdpWfGdYKd3QB9">documentation</span> contains <span class=3D"gmail-YP=
kS7KbdpWfGdYKd3QB9">information</span> <span class=3D"gmail-YPkS7KbdpWfGdYK=
d3QB9">about</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">only</span> =
<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">one</span> <span class=3D"gmail-=
YPkS7KbdpWfGdYKd3QB9">difference</span> <span class=3D"gmail-YPkS7KbdpWfGdY=
Kd3QB9">-</span> when we <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">bump</s=
pan> at <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">the</span> <span class=
=3D"gmail-YPkS7KbdpWfGdYKd3QB9">step1</span> Proxy <span class=3D"gmail-YPk=
S7KbdpWfGdYKd3QB9">first</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">=
establishes</span> a <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">TLS</span> =
<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">connection</span> <span class=3D=
"gmail-YPkS7KbdpWfGdYKd3QB9">with</span> the C<span class=3D"gmail-YPkS7Kbd=
pWfGdYKd3QB9">lient</span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">,</spa=
n> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">and</span> <span class=3D"gma=
il-YPkS7KbdpWfGdYKd3QB9">then</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3=
QB9">with</span> the S<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">erver</spa=
n><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">,</span> <span class=3D"gmail-=
YPkS7KbdpWfGdYKd3QB9">while</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB=
9">in</span> the other <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">cases</sp=
an> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">-</span> <span class=3D"gmai=
l-YPkS7KbdpWfGdYKd3QB9">first</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3=
QB9">with</span> the S<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">erver</spa=
n><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">,</span> <span class=3D"gmail-=
YPkS7KbdpWfGdYKd3QB9">and</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9"=
>then</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">with</span> the C<s=
pan class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">lient</span><span class=3D"gmail-Y=
PkS7KbdpWfGdYKd3QB9">.</span></span></div><div><span class=3D"gmail-YPkS7Kb=
dpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;"><span class=3D"gma=
il-YPkS7KbdpWfGdYKd3QB9"><br></span></span></div><div><span class=3D"gmail-=
YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;"><span class=
=3D"gmail-YPkS7KbdpWfGdYKd3QB9">I looked into</span> <span class=3D"gmail-Y=
PkS7KbdpWfGdYKd3QB9">this</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9"=
>issue</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">and</span> <span c=
lass=3D"gmail-YPkS7KbdpWfGdYKd3QB9">tried</span> to <span class=3D"gmail-YP=
kS7KbdpWfGdYKd3QB9">summarize</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3=
QB9">the</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">information</spa=
n> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">I</span> have (I will not det=
ail here the information available to the admin at each of the three steps)=
<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">. Maybe it will help someone.</s=
pan></span></div><div><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"w=
hite-space-collapse: preserve;"><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">=
<br></span></span></div><div><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" sty=
le=3D"white-space-collapse: preserve;"><span class=3D"gmail-YPkS7KbdpWfGdYK=
d3QB9"><b>1. step1</b></span></span></div><div>Conf:</div><div><font face=
=3D"monospace">ssl_bump bump step1</font></div><div><br></div><div>Workflow=
:</div><div><font face=3D"monospace">step 1 (bump)<br>1. Client -> CONNE=
CT aaa.bbb.ccc.ddd -> Proxy<br>2. Proxy -> HTTP 200 Connection establ=
ished -> Client<br>3. Client -> Client Hello (SNI) -> Proxy<br>4. =
Proxy -> Makes Server Hello (with fake certificate for the SNI host) -&g=
t; Client<br>5. Client <- Complete TLS handshake -> Proxy<br>6. Proxy=
-> Makes Client Hello (based on the Client Hello SNI, but uses its own =
cipher suites and TLS version) -> Server<br>7. Server -> Server Hello=
-> Proxy<br>8. Proxy <- Complete TLS handshake -> =C2=A0Server<br=
>9. Client -> HTTP Request -> Proxy<br>10. Proxy -> HTTP Request -=
> Server<br>11. Server -> HTTP Response -> Proxy<br>12. Proxy ->=
; HTTP Response -> Client<br>...</font></div><div><br></div><div><div><s=
pan class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: pre=
serve;"><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9"><b>2. step2</b></span></=
span></div><div>Conf:</div><div><font face=3D"monospace">ssl_bump stare ste=
p1</font></div><div><font face=3D"monospace">ssl_bump bump step2</font></di=
v><div><br></div><div>Workflow:</div></div><div><font face=3D"monospace">st=
ep 1 (stare)<br>1. Client -> CONNECT=C2=A0</font>
<span style=3D"font-family:monospace">aaa.bbb.ccc.ddd</span>=C2=A0<font fac=
e=3D"monospace">=C2=A0-> Proxy<br>2. Proxy -> HTTP 200 Connection est=
ablished -> Client<br>=C2=A0<br>step 2 (bump)<br>3. Client -> Client =
Hello (SNI) -> Proxy<br>4. Proxy -> Makes Client Hello (based on the =
Client Hello SNI, but <b>uses its own cipher suites</b> and TLS version) -&=
gt; Server<br>5. Server -> Server Hello -> Proxy<br>6. Proxy <- Co=
mplete TLS handshake -> =C2=A0Server<br>7. Proxy -> Makes Server Hell=
o (with fake certificate for the SNI host with mimicked attributes) -> C=
lient<br>8. Client <- Complete TLS handshake -> Proxy<br>9. Client -&=
gt; HTTP Request -> Proxy<br>10. Proxy -> HTTP Request -> Server<b=
r>11. Server -> HTTP Response -> Proxy<br>12. Proxy -> HTTP Respon=
se -> Client<br>...</font></div><div><br></div><div><div><span class=3D"=
gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;"><span=
class=3D"gmail-YPkS7KbdpWfGdYKd3QB9"><b>3. step3</b></span></span></div><d=
iv>Conf:</div><div><font face=3D"monospace">ssl_bump stare step1</font></di=
v><div><font face=3D"monospace">ssl_bump stare step2</font></div><div><font=
face=3D"monospace">ssl_bump bump step3</font></div><div><br></div><div>Wor=
kflow:</div></div><div><font face=3D"monospace">step 1 (stare)<br>1. Client=
-> CONNECT=C2=A0</font>
<span style=3D"font-family:monospace">aaa.bbb.ccc.ddd</span>=C2=A0<font fac=
e=3D"monospace">=C2=A0-> Proxy<br>2. Proxy -> HTTP 200 Connection est=
ablished -> Client<br>=C2=A0<br>step 2 (stare)<br>3. Client -> Client=
Hello (SNI) -> Proxy<br>=C2=A0<br>step 3 (bump)<br>4. Proxy -> Makes=
Client Hello (based on the real Client Hello SNI, and uses <b>Client's=
cipher suites</b> but its own TLS version) -> Server<br>5. Server ->=
Server Hello -> Proxy<br>6. Proxy <- Complete TLS handshake -> =
=C2=A0Server<br>7. Proxy -> Makes Server Hello (with fake certificate fo=
r the SNI host with mimicked attributes) -> Client<br>8. Client <- Co=
mplete TLS handshake -> Proxy<br>9. Client -> HTTP Request -> Prox=
y<br>10. Proxy -> HTTP Request -> Server<br>11. Server -> HTTP Res=
ponse -> Proxy<br>12. Proxy -> HTTP Response -> Client<br>...</fon=
t></div><div><br></div><div>We obtained these data by analyzing network dum=
ps for each configuration.</div><div><br></div><div>Bumping at steps 2 and =
3 are very=C2=A0<span style=3D"white-space-collapse: preserve;">similar</sp=
an><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse=
: preserve;">,</span><span style=3D"white-space-collapse: preserve;"> </spa=
n><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse:=
preserve;">but</span><span style=3D"white-space-collapse: preserve;"> </sp=
an><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse=
: preserve;">in</span><span style=3D"white-space-collapse: preserve;"> the =
</span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-coll=
apse: preserve;">first</span><span style=3D"white-space-collapse: preserve;=
"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-c=
ollapse: preserve;">case</span><span style=3D"white-space-collapse: preserv=
e;">, </span><span style=3D"white-space-collapse: preserve;">P</span><span =
class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserv=
e;">roxy</span><span style=3D"white-space-collapse: preserve;"> </span><spa=
n class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: prese=
rve;">sends</span><span style=3D"white-space-collapse: preserve;"> </span><=
span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: pr=
eserve;">Client</span><span style=3D"white-space-collapse: preserve;"> </sp=
an><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse=
: preserve;">Hello</span><span style=3D"white-space-collapse: preserve;"> t=
o a Server </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white=
-space-collapse: preserve;">with</span><span style=3D"white-space-collapse:=
preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"whi=
te-space-collapse: preserve;">its</span><span style=3D"white-space-collapse=
: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"wh=
ite-space-collapse: preserve;">own</span><span style=3D"white-space-collaps=
e: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"w=
hite-space-collapse: preserve;">ciphers</span><span class=3D"gmail-YPkS7Kbd=
pWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">,</span><span style=
=3D"white-space-collapse: preserve;"> </span><span class=3D"gmail-YPkS7Kbdp=
WfGdYKd3QB9" style=3D"white-space-collapse: preserve;">and</span><span styl=
e=3D"white-space-collapse: preserve;"> </span><span class=3D"gmail-YPkS7Kbd=
pWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">in</span><span styl=
e=3D"white-space-collapse: preserve;"> the </span><span class=3D"gmail-YPkS=
7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">latter</span><s=
pan style=3D"white-space-collapse: preserve;"> case - </span><span class=3D=
"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">with=
</span><span style=3D"white-space-collapse: preserve;"> </span><span class=
=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">c=
iphers</span>
<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: p=
reserve;">received</span><span style=3D"white-space-collapse: preserve;"> <=
/span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-colla=
pse: preserve;">from</span><span style=3D"white-space-collapse: preserve;">=
the </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space=
-collapse: preserve;">Client</span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB=
9" style=3D"white-space-collapse: preserve;">.</span></div><div><br></div><=
div>If anyone has any comments or additions, please feel free to complete i=
t.</div><div><br></div><div>Kind regards,</div><div>=C2=A0 =C2=A0 Ankor.</d=
iv><div><br></div><div><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"=
white-space-collapse: preserve;"><br></span></div><div><span class=3D"gmail=
-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">
</span></div></div>
--000000000000c689c1064c57c57e--
--===============3870142095813979138==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users
--===============3870142095813979138==--