You can. What you do is take the Client Hello packet, and inspect the public SNI field. This will show you the destination to proxy to. Your forward to that server, and that server then completes the handshake.
No matter if you are using TLS over TCP (or HTTPS) or DTLS - end-to-end-encryption can be kept up simply by proxying on the first step of the Handshake.
I should have clarified... when I said "proxy TLS" I meant while retaining the typical features that reverse proxy providers offer like those I mentioned here: https://news.ycombinator.com/item?id=49662319
If for example Cloudflare decided to offer this SNI-based TLS passthrough, they could no longer give you adequate DDoS protection, caching, analytics etc.
I disagree. What you do (well, and what I do in my code) is this: You cache the original IP packets containing the Client Hello. You inspect those packets. And you make your DDoS protection etc based on this. And if you decide the packet is OK forwarding, only then you replay the original IP packets to the destination.
I know that you can not inspect content this way. But there simply are situations where content SHOULD NOT be inspected.
Comments
You can. What you do is take the Client Hello packet, and inspect the public SNI field. This will show you the destination to proxy to. Your forward to that server, and that server then completes the handshake.
No matter if you are using TLS over TCP (or HTTPS) or DTLS - end-to-end-encryption can be kept up simply by proxying on the first step of the Handshake.
That is the correct way how to do it.
I should have clarified... when I said "proxy TLS" I meant while retaining the typical features that reverse proxy providers offer like those I mentioned here: https://news.ycombinator.com/item?id=49662319
If for example Cloudflare decided to offer this SNI-based TLS passthrough, they could no longer give you adequate DDoS protection, caching, analytics etc.
I disagree. What you do (well, and what I do in my code) is this: You cache the original IP packets containing the Client Hello. You inspect those packets. And you make your DDoS protection etc based on this. And if you decide the packet is OK forwarding, only then you replay the original IP packets to the destination.
I know that you can not inspect content this way. But there simply are situations where content SHOULD NOT be inspected.