Why TLS is better without STARTTLS (2021)

• CoreFX

  15 17,856 0.0

  Discontinued This repo is used for servicing PR's for .NET Core 2.1 and 3.1. Please visit us at https://github.com/dotnet/runtime

  

https://github.com/dotnet/corefx/pull/28278

• fabio

  7 7,252 0.0 Go

  Consul Load-Balancing made simple

  

Sniffing the SNI from the underlying TCP connection is the proper way to do this.

a couple examples I know of(only know go ones of the top of my head):

https://github.com/fabiolb/fabio/blob/master/proxy/tcp/tls_c...

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• mostly-harmless

  1 212 8.3 JavaScript

  A bag of various unrelated projects with varying levels of serviceability and destructiveness.

https://github.com/FiloSottile/mostly-harmless/blob/main/tal...

> I don't like doing that but the only other way is to "roll my own crypto" which I understand is a bad thing.

You're would not be rolling your own cryptographic primitive, or combining existing ones in strange and speculative ways. This is what most people, most of the time mean when they admonish against rolling your own crypto.

All you'd have to do is parse the ClientHello to retrieve the SNI. you're in a memory safe language, so parsing bugs result in a crash, not a buffer overflow. I'd say you're on pretty firm ground.

Suggest a related project