proxy/tls: TLS termination by Portail - #165
Draft
rlahfa-dinum wants to merge 3 commits into
Draft
Conversation
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 10:06
e2c4812 to
306484b
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 10:20
306484b to
a9199af
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 10:21
a9199af to
f292935
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 10:26
f292935 to
464d23b
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 10:27
464d23b to
623d4f3
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
2 times, most recently
from
August 7, 2026 11:27
c737114 to
e31cd15
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 11:45
e31cd15 to
0596f33
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
2 times, most recently
from
August 7, 2026 13:28
9db5fb2 to
464f659
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 14:48
464f659 to
b3c16bc
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
2 times, most recently
from
August 7, 2026 14:52
8c693d9 to
6cf19cf
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 15:36
6cf19cf to
af7b48c
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 15:37
af7b48c to
f91d577
Compare
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 15:37
f91d577 to
6d390f3
Compare
We now analyze deeply the client hello, including PQC details. Those details will be exposed in the ACL as well to enable PQC transition. Signed-off-by: Ryan Lahfa <ryan.lahfa.ext@numerique.gouv.fr>
Signed-off-by: Ryan Lahfa <ryan.lahfa.ext@numerique.gouv.fr>
Signed-off-by: Ryan Lahfa <ryan.lahfa.ext@numerique.gouv.fr>
rlahfa-dinum
force-pushed
the
tls-sni-extraction
branch
from
August 7, 2026 18:19
6d390f3 to
7e661da
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a draft.
Portail did not perform any TLS termination inside tunnels which made it blind about ongoing requests.
In the scenario where Portail is equiped to terminate TLS, e.g. the right wildcard certificates, Portail will not transfer blindly the contents and will terminate the inner TLS stream and replay it to the final origin, acting as a TLS termination proxy.
In this scenario, Portail will run an additional set of ACL rules inside of the tunnel, this time with full context about the exact requests being done.
This introduces small latency but greatly increase the security of the scheme.
Stack created with GitHub Stacks CLI • Give Feedback 💬