Is there a way to get the TLS client-hello in a plugin?

Traefik Traefik v3 (latest)
1

I'm building a plugin and I need to compute a JA3/JA4 hash from the request. I cannot seem to find any way to accessing the raw TLS client-hello? Is there a way to do this?

func (sh *MyPlugin) ServeHTTP(rw http.ResponseWriter, req *http.Request) {
  // req.TLS has everything but the raw hello
}

Without the CH, there doesn't seem to way to build the JA3/4 hash. Thank you.

2

This is probably not possible, as Traefik's model is

entrypoint -> router -> middleware -> service

and TLS is usually terminated before the router.

1 Like
3

Yeah, this really doesn't seem possible. I found this issue TLS(Ja3) Fingerprint in ForwardAuth Middleware · Issue #8627 · traefik/traefik · GitHub