SSL Bump differences at various steps

Andrey K <[email protected]> Fri, 6 Mar 2026 12:35:13 +0300
Newsgroups gmane.comp.web.squid.general
Message-ID <CADJd0Y2NTfHV3=xTmZo6-szzoOEhROWhnhUsGY0k2KmcSbWqYw@mail.gmail.com>
--===============3870142095813979138==
Content-Type: multipart/alternative; boundary="000000000000c689c1064c57c57e"

--000000000000c689c1064c57c57e
Content-Type: text/plain; charset="UTF-8"

Hello,

I was wondering what are the differences if we apply the ssl bump operation
at different steps?
The documentation contains information about only one difference - when we
bump at the step1 Proxy first establishes a TLS connection with the Client,
and then with the Server, while in the other cases - first with the Server,
and then with the Client.

I looked into this issue and tried to summarize the information I have (I
will not detail here the information available to the admin at each of the
three steps). Maybe it will help someone.

*1. step1*
Conf:
ssl_bump bump step1

Workflow:
step 1 (bump)
1. Client -> CONNECT aaa.bbb.ccc.ddd -> Proxy
2. Proxy -> HTTP 200 Connection established -> Client
3. Client -> Client Hello (SNI) -> Proxy
4. Proxy -> Makes Server Hello (with fake certificate for the SNI host) ->
Client
5. Client <- Complete TLS handshake -> Proxy
6. Proxy -> Makes Client Hello (based on the Client Hello SNI, but uses its
own cipher suites and TLS version) -> Server
7. Server -> Server Hello -> Proxy
8. Proxy <- Complete TLS handshake ->  Server
9. Client -> HTTP Request -> Proxy
10. Proxy -> HTTP Request -> Server
11. Server -> HTTP Response -> Proxy
12. Proxy -> HTTP Response -> Client
...

*2. step2*
Conf:
ssl_bump stare step1
ssl_bump bump step2

Workflow:
step 1 (stare)
1. Client -> CONNECT  aaa.bbb.ccc.ddd  -> Proxy
2. Proxy -> HTTP 200 Connection established -> Client

step 2 (bump)
3. Client -> Client Hello (SNI) -> Proxy
4. Proxy -> Makes Client Hello (based on the Client Hello SNI, but *uses
its own cipher suites* and TLS version) -> Server
5. Server -> Server Hello -> Proxy
6. Proxy <- Complete TLS handshake ->  Server
7. Proxy -> Makes Server Hello (with fake certificate for the SNI host with
mimicked attributes) -> Client
8. Client <- Complete TLS handshake -> Proxy
9. Client -> HTTP Request -> Proxy
10. Proxy -> HTTP Request -> Server
11. Server -> HTTP Response -> Proxy
12. Proxy -> HTTP Response -> Client
...

*3. step3*
Conf:
ssl_bump stare step1
ssl_bump stare step2
ssl_bump bump step3

Workflow:
step 1 (stare)
1. Client -> CONNECT  aaa.bbb.ccc.ddd  -> Proxy
2. Proxy -> HTTP 200 Connection established -> Client

step 2 (stare)
3. Client -> Client Hello (SNI) -> Proxy

step 3 (bump)
4. Proxy -> Makes Client Hello (based on the real Client Hello SNI, and
uses *Client's cipher suites* but its own TLS version) -> Server
5. Server -> Server Hello -> Proxy
6. Proxy <- Complete TLS handshake ->  Server
7. Proxy -> Makes Server Hello (with fake certificate for the SNI host with
mimicked attributes) -> Client
8. Client <- Complete TLS handshake -> Proxy
9. Client -> HTTP Request -> Proxy
10. Proxy -> HTTP Request -> Server
11. Server -> HTTP Response -> Proxy
12. Proxy -> HTTP Response -> Client
...

We obtained these data by analyzing network dumps for each configuration.

Bumping at steps 2 and 3 are very similar, but in the first case, Proxy
sends Client Hello to a Server with its own ciphers, and in the latter case
- with ciphers received from the Client.

If anyone has any comments or additions, please feel free to complete it.

Kind regards,
    Ankor.

--000000000000c689c1064c57c57e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello,<div><br></div><div><span class=3D"gmail-YPkS7KbdpWf=
GdYKd3QB9" style=3D"white-space-collapse: preserve;">I</span><span style=3D=
"white-space-collapse: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfG=
dYKd3QB9" style=3D"white-space-collapse: preserve;">was</span><span style=
=3D"white-space-collapse: preserve;"> </span><span class=3D"gmail-YPkS7Kbdp=
WfGdYKd3QB9" style=3D"white-space-collapse: preserve;">wondering</span><spa=
n style=3D"white-space-collapse: preserve;"> </span><span class=3D"gmail-YP=
kS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">what</span><s=
pan style=3D"white-space-collapse: preserve;"> are the </span><span class=
=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">d=
ifferences</span><span style=3D"white-space-collapse: preserve;"> if we app=
ly the </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-spa=
ce-collapse: preserve;">ssl</span><span style=3D"white-space-collapse: pres=
erve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-sp=
ace-collapse: preserve;">bump operation</span><span style=3D"white-space-co=
llapse: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=
=3D"white-space-collapse: preserve;">at</span><span style=3D"white-space-co=
llapse: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=
=3D"white-space-collapse: preserve;">different</span><span style=3D"white-s=
pace-collapse: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9=
" style=3D"white-space-collapse: preserve;">steps</span><span class=3D"gmai=
l-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">?</span><=
/div><div><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-c=
ollapse: preserve;">
<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">The</span> <span class=3D"gmail-=
YPkS7KbdpWfGdYKd3QB9">documentation</span> contains <span class=3D"gmail-YP=
kS7KbdpWfGdYKd3QB9">information</span> <span class=3D"gmail-YPkS7KbdpWfGdYK=
d3QB9">about</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">only</span> =
<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">one</span> <span class=3D"gmail-=
YPkS7KbdpWfGdYKd3QB9">difference</span> <span class=3D"gmail-YPkS7KbdpWfGdY=
Kd3QB9">-</span> when we <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">bump</s=
pan> at <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">the</span> <span class=
=3D"gmail-YPkS7KbdpWfGdYKd3QB9">step1</span> Proxy <span class=3D"gmail-YPk=
S7KbdpWfGdYKd3QB9">first</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">=
establishes</span> a <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">TLS</span> =
<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">connection</span> <span class=3D=
"gmail-YPkS7KbdpWfGdYKd3QB9">with</span> the C<span class=3D"gmail-YPkS7Kbd=
pWfGdYKd3QB9">lient</span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">,</spa=
n> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">and</span> <span class=3D"gma=
il-YPkS7KbdpWfGdYKd3QB9">then</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3=
QB9">with</span> the S<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">erver</spa=
n><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">,</span> <span class=3D"gmail-=
YPkS7KbdpWfGdYKd3QB9">while</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB=
9">in</span> the other <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">cases</sp=
an> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">-</span> <span class=3D"gmai=
l-YPkS7KbdpWfGdYKd3QB9">first</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3=
QB9">with</span> the S<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">erver</spa=
n><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">,</span> <span class=3D"gmail-=
YPkS7KbdpWfGdYKd3QB9">and</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9"=
>then</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">with</span> the C<s=
pan class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">lient</span><span class=3D"gmail-Y=
PkS7KbdpWfGdYKd3QB9">.</span></span></div><div><span class=3D"gmail-YPkS7Kb=
dpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;"><span class=3D"gma=
il-YPkS7KbdpWfGdYKd3QB9"><br></span></span></div><div><span class=3D"gmail-=
YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;"><span class=
=3D"gmail-YPkS7KbdpWfGdYKd3QB9">I looked into</span> <span class=3D"gmail-Y=
PkS7KbdpWfGdYKd3QB9">this</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9"=
>issue</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">and</span> <span c=
lass=3D"gmail-YPkS7KbdpWfGdYKd3QB9">tried</span> to <span class=3D"gmail-YP=
kS7KbdpWfGdYKd3QB9">summarize</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3=
QB9">the</span> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">information</spa=
n> <span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">I</span> have (I will not det=
ail here the information available to the admin at each of the three steps)=
<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">. Maybe it will help someone.</s=
pan></span></div><div><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"w=
hite-space-collapse: preserve;"><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9">=
<br></span></span></div><div><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" sty=
le=3D"white-space-collapse: preserve;"><span class=3D"gmail-YPkS7KbdpWfGdYK=
d3QB9"><b>1. step1</b></span></span></div><div>Conf:</div><div><font face=
=3D"monospace">ssl_bump bump step1</font></div><div><br></div><div>Workflow=
:</div><div><font face=3D"monospace">step 1 (bump)<br>1. Client -&gt; CONNE=
CT aaa.bbb.ccc.ddd -&gt; Proxy<br>2. Proxy -&gt; HTTP 200 Connection establ=
ished -&gt; Client<br>3. Client -&gt; Client Hello (SNI) -&gt; Proxy<br>4. =
Proxy -&gt; Makes Server Hello (with fake certificate for the SNI host) -&g=
t; Client<br>5. Client &lt;- Complete TLS handshake -&gt; Proxy<br>6. Proxy=
 -&gt; Makes Client Hello (based on the Client Hello SNI, but uses its own =
cipher suites and TLS version) -&gt; Server<br>7. Server -&gt; Server Hello=
 -&gt; Proxy<br>8. Proxy &lt;- Complete TLS handshake -&gt; =C2=A0Server<br=
>9. Client -&gt; HTTP Request -&gt; Proxy<br>10. Proxy -&gt; HTTP Request -=
&gt; Server<br>11. Server -&gt; HTTP Response -&gt; Proxy<br>12. Proxy -&gt=
; HTTP Response -&gt; Client<br>...</font></div><div><br></div><div><div><s=
pan class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: pre=
serve;"><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9"><b>2. step2</b></span></=
span></div><div>Conf:</div><div><font face=3D"monospace">ssl_bump stare ste=
p1</font></div><div><font face=3D"monospace">ssl_bump bump step2</font></di=
v><div><br></div><div>Workflow:</div></div><div><font face=3D"monospace">st=
ep 1 (stare)<br>1. Client -&gt; CONNECT=C2=A0</font>

<span style=3D"font-family:monospace">aaa.bbb.ccc.ddd</span>=C2=A0<font fac=
e=3D"monospace">=C2=A0-&gt; Proxy<br>2. Proxy -&gt; HTTP 200 Connection est=
ablished -&gt; Client<br>=C2=A0<br>step 2 (bump)<br>3. Client -&gt; Client =
Hello (SNI) -&gt; Proxy<br>4. Proxy -&gt; Makes Client Hello (based on the =
Client Hello SNI, but <b>uses its own cipher suites</b> and TLS version) -&=
gt; Server<br>5. Server -&gt; Server Hello -&gt; Proxy<br>6. Proxy &lt;- Co=
mplete TLS handshake -&gt; =C2=A0Server<br>7. Proxy -&gt; Makes Server Hell=
o (with fake certificate for the SNI host with mimicked attributes) -&gt; C=
lient<br>8. Client &lt;- Complete TLS handshake -&gt; Proxy<br>9. Client -&=
gt; HTTP Request -&gt; Proxy<br>10. Proxy -&gt; HTTP Request -&gt; Server<b=
r>11. Server -&gt; HTTP Response -&gt; Proxy<br>12. Proxy -&gt; HTTP Respon=
se -&gt; Client<br>...</font></div><div><br></div><div><div><span class=3D"=
gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;"><span=
 class=3D"gmail-YPkS7KbdpWfGdYKd3QB9"><b>3. step3</b></span></span></div><d=
iv>Conf:</div><div><font face=3D"monospace">ssl_bump stare step1</font></di=
v><div><font face=3D"monospace">ssl_bump stare step2</font></div><div><font=
 face=3D"monospace">ssl_bump bump step3</font></div><div><br></div><div>Wor=
kflow:</div></div><div><font face=3D"monospace">step 1 (stare)<br>1. Client=
 -&gt; CONNECT=C2=A0</font>

<span style=3D"font-family:monospace">aaa.bbb.ccc.ddd</span>=C2=A0<font fac=
e=3D"monospace">=C2=A0-&gt; Proxy<br>2. Proxy -&gt; HTTP 200 Connection est=
ablished -&gt; Client<br>=C2=A0<br>step 2 (stare)<br>3. Client -&gt; Client=
 Hello (SNI) -&gt; Proxy<br>=C2=A0<br>step 3 (bump)<br>4. Proxy -&gt; Makes=
 Client Hello (based on the real Client Hello SNI, and uses <b>Client&#39;s=
 cipher suites</b> but its own TLS version) -&gt; Server<br>5. Server -&gt;=
 Server Hello -&gt; Proxy<br>6. Proxy &lt;- Complete TLS handshake -&gt; =
=C2=A0Server<br>7. Proxy -&gt; Makes Server Hello (with fake certificate fo=
r the SNI host with mimicked attributes) -&gt; Client<br>8. Client &lt;- Co=
mplete TLS handshake -&gt; Proxy<br>9. Client -&gt; HTTP Request -&gt; Prox=
y<br>10. Proxy -&gt; HTTP Request -&gt; Server<br>11. Server -&gt; HTTP Res=
ponse -&gt; Proxy<br>12. Proxy -&gt; HTTP Response -&gt; Client<br>...</fon=
t></div><div><br></div><div>We obtained these data by analyzing network dum=
ps for each configuration.</div><div><br></div><div>Bumping at steps 2 and =
3 are very=C2=A0<span style=3D"white-space-collapse: preserve;">similar</sp=
an><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse=
: preserve;">,</span><span style=3D"white-space-collapse: preserve;"> </spa=
n><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse:=
 preserve;">but</span><span style=3D"white-space-collapse: preserve;"> </sp=
an><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse=
: preserve;">in</span><span style=3D"white-space-collapse: preserve;"> the =
</span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-coll=
apse: preserve;">first</span><span style=3D"white-space-collapse: preserve;=
"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-c=
ollapse: preserve;">case</span><span style=3D"white-space-collapse: preserv=
e;">, </span><span style=3D"white-space-collapse: preserve;">P</span><span =
class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserv=
e;">roxy</span><span style=3D"white-space-collapse: preserve;"> </span><spa=
n class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: prese=
rve;">sends</span><span style=3D"white-space-collapse: preserve;"> </span><=
span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: pr=
eserve;">Client</span><span style=3D"white-space-collapse: preserve;"> </sp=
an><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse=
: preserve;">Hello</span><span style=3D"white-space-collapse: preserve;"> t=
o a Server </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white=
-space-collapse: preserve;">with</span><span style=3D"white-space-collapse:=
 preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"whi=
te-space-collapse: preserve;">its</span><span style=3D"white-space-collapse=
: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"wh=
ite-space-collapse: preserve;">own</span><span style=3D"white-space-collaps=
e: preserve;"> </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"w=
hite-space-collapse: preserve;">ciphers</span><span class=3D"gmail-YPkS7Kbd=
pWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">,</span><span style=
=3D"white-space-collapse: preserve;"> </span><span class=3D"gmail-YPkS7Kbdp=
WfGdYKd3QB9" style=3D"white-space-collapse: preserve;">and</span><span styl=
e=3D"white-space-collapse: preserve;"> </span><span class=3D"gmail-YPkS7Kbd=
pWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">in</span><span styl=
e=3D"white-space-collapse: preserve;"> the </span><span class=3D"gmail-YPkS=
7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">latter</span><s=
pan style=3D"white-space-collapse: preserve;"> case - </span><span class=3D=
"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">with=
</span><span style=3D"white-space-collapse: preserve;"> </span><span class=
=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">c=
iphers</span>

<span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: p=
reserve;">received</span><span style=3D"white-space-collapse: preserve;"> <=
/span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-colla=
pse: preserve;">from</span><span style=3D"white-space-collapse: preserve;">=
 the </span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space=
-collapse: preserve;">Client</span><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB=
9" style=3D"white-space-collapse: preserve;">.</span></div><div><br></div><=
div>If anyone has any comments or additions, please feel free to complete i=
t.</div><div><br></div><div>Kind regards,</div><div>=C2=A0 =C2=A0 Ankor.</d=
iv><div><br></div><div><span class=3D"gmail-YPkS7KbdpWfGdYKd3QB9" style=3D"=
white-space-collapse: preserve;"><br></span></div><div><span class=3D"gmail=
-YPkS7KbdpWfGdYKd3QB9" style=3D"white-space-collapse: preserve;">



</span></div></div>

--000000000000c689c1064c57c57e--

--===============3870142095813979138==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
squid-users mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-users

--===============3870142095813979138==--