read-tls-client-hello

import * as https from 'https'; import { trackClientHellos } from 'read-tls-client-hello'; import type { TlsClientHelloMessage } from 'read-tls-client-hello'; // In a real application, you'd load these from environment variables or a config file. // For example, using `mkcert` to generate local TLS certificates: // mkcert -install // mkcert localhost const key = process.env.TLS_KEY ?? ''; // Replace with your actual TLS private key content const cert = process.env.TLS_CERT ?? ''; // Replace with your actual TLS certificate content if (!key || !cert) { console.error('TLS_KEY and TLS_CERT environment variables are required for the example.'); process.exit(1); } const server = new https.Server({ key, cert }); trackClientHellos(server); // <-- Automatically track everything on this server server.on('request', (request, response) => { const socket = request.socket as (typeof request.socket & { tlsClientHello?: TlsClientHelloMessage }); // In your normal request handler, check `tlsClientHello` on the request's socket: if (socket.tlsClientHello) { console.log('Received request with TLS client hello:', { version: socket.tlsClientHello.version, sni: socket.tlsClientHello.extensions.find(ext => ext.id === 0)?.data?.server_name, ja3: socket.tlsClientHello.ja3, ja4: socket.tlsClientHello.ja4 }); } else { console.log('Received request without TLS client hello data (e.g., HTTP/2 over TLS without initial ClientHello tracking, or an error occurred).'); } response.writeHead(200, { 'Content-Type': 'text/plain' }); response.end('Hello from tracked server!'); }); server.listen(8443, () => { console.log('HTTPS server listening on https://localhost:8443'); console.log('Try connecting with curl: curl -k https://localhost:8443'); });