{"id":52639,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/domen-fronting-na-baze-tls-1-3"},"modified":"2026-05-20T19:54:20","modified_gmt":"2026-05-20T17:54:20","slug":"domen-fronting-na-baze-tls-1-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","title":{"rendered":"Domain-frontrendszer TLS 1.3 alapokon","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bevezet\u00e9s<\/h3>\n

\"Domain-frontrendszer
\nA modern corporate content filtering system from renowned manufacturers such as Cisco, BlueCoat, and FireEye shares a lot in common with their more powerful counterparts \u2014 DPI systems, which are being actively implemented at the national level. The essence of both is to inspect incoming and outgoing internet traffic and, based on black\/white lists, decide whether to block an internet connection. And since both rely on similar principles in their operation, the methods of bypassing them will also have much in common.<\/p>\n

One of the technologies that allows for effectively bypassing both DPI and corporate systems is domain fronting technology. Its essence lies in accessing a blocked resource by disguising it with another public domain that has a good reputation, which will purposely not be blocked by any system, for example google.com.<\/p>\n

A significant number of articles and examples have already been written about this technology. However, the popular and recently discussed technologies DNS-over-HTTPS and encrypted SNI, as well as the new version of the TLS 1.3 protocol, allow us to consider one more option for domain fronting.
\n<\/a><\/p>\n

Understanding the technology<\/h3>\n

First, let\u2019s clarify some basic concepts so that everyone understands who is who and why all this is necessary. We mentioned the eSNI mechanism, the operation of which will be discussed further. The eSNI (encrypted Server Name Indication) mechanism is a secure version of SNI available only for the TLS 1.3 protocol. The main point is to encrypt the information regarding which domain the request is sent to.<\/p>\n

Now, let\u2019s look at the eSNI mechanism in practice.<\/p>\n

Suppose we have an internet resource that is blocked by a modern DPI solution (let's take a famous torrent tracker as an example \u2014 rutracker.nl). When trying to access the torrent tracker site, we see the provider\u2019s standard blocking message:<\/p>\n

\"Domain-frontrendszer<\/p>\n

On the RKN website, this domain is indeed listed in the stop lists:<\/p>\n

\"Domain-frontrendszer<\/p>\n

When requesting a whois, it is clear that the domain itself is 'hidden' behind the cloud provider Cloudflare.<\/p>\n

\"Domain-frontrendszer<\/p>\n

De a k\u00fcl\u00f6nb\u00f6z\u0151 RKN-es \"szak\u00e9rt\u0151kt\u0151l\" elt\u00e9r\u0151en, a technikailag k\u00e9pzettebb belai munkat\u00e1rsak (vagy a h\u00edres szab\u00e1lyoz\u00f3nk keser\u0171 tapasztalataib\u00f3l tanulva) nem egyszer\u0171en az IP-c\u00edm alapj\u00e1n tiltotta le a weboldalt, hanem a feketelist\u00e1ra pontosan a domain nevet<\/a>. Ezt k\u00f6nnyen igazolhatjuk, ha megn\u00e9zz\u00fck, hogy milyen m\u00e1s domainek rejt\u0151znek ezen a n\u00e9ven IP-c\u00edm<\/a>, megl\u00e1togatunk egyet, \u00e9s l\u00e1tjuk, hogy a hozz\u00e1f\u00e9r\u00e9s nem blokkolt:<\/p>\n

\"Domain-frontrendszer<\/p>\n

De hogyan lehets\u00e9ges ez? Hogyan tudja a szolg\u00e1ltat\u00f3 DPI, hogy melyik domainhez megy a b\u00f6ng\u00e9sz\u0151m, hiszen minden kommunik\u00e1ci\u00f3 HTTPS protokollon t\u00f6rt\u00e9nik, \u00e9s a belai HTTPS tan\u00fas\u00edtv\u00e1nyok cser\u00e9je eddig nem t\u0171nt fel? Tal\u00e1n l\u00e1t\u00f3, vagy k\u00f6vetnek engem?<\/p>\n

Pr\u00f3b\u00e1ljunk megv\u00e1laszolni erre a k\u00e9rd\u00e9sre, \u00e9s n\u00e9zz\u00fck meg a forgalmat a Wireshark seg\u00edts\u00e9g\u00e9vel.<\/p>\n

\"Domain-frontrendszer<\/p>\n

A k\u00e9perny\u0151k\u00e9pen l\u00e1that\u00f3, hogy a b\u00f6ng\u00e9sz\u0151 el\u0151sz\u00f6r DNS-en kereszt\u00fcl megkapja a szerver IP-c\u00edm\u00e9t, majd t\u00f6rt\u00e9nik egy szabv\u00e1nyos TCP k\u00e9zfog\u00e1s a c\u00e9l szerverrel, ezut\u00e1n a b\u00f6ng\u00e9sz\u0151 pr\u00f3b\u00e1l SSL-kapcsolatot l\u00e9tes\u00edteni a szerverrel. Ehhez elk\u00fcldi a SSL<\/a> Client Hello csomagot, amelyben ny\u00edltan szerepel az eredeti domain neve. Ezt a mez\u0151t a Cloudflare frontend szerver\u00e9nek sz\u00fcks\u00e9ge van a kapcsolat helyes ir\u00e1ny\u00edt\u00e1s\u00e1hoz. Itt ragadja el a kapcsolatot a szolg\u00e1ltat\u00f3 DPI, megszak\u00edtva azt. Mik\u00f6zben nem kapunk semmilyen \u00fczenetet a szolg\u00e1ltat\u00f3t\u00f3l, a b\u00f6ng\u00e9sz\u0151 \u00e1lland\u00f3 hib\u00e1t jelez, mintha az oldal le lenne kapcsolva, vagy egyszer\u0171en nem m\u0171k\u00f6dik:<\/p>\n

\"Domain-frontrendszer<\/p>\n

Most pedig aktiv\u00e1ljuk az eSNI mechanizmust a b\u00f6ng\u00e9sz\u0151ben, ahogyan az az Firefox <\/a>:
\nFirefox konfigur\u00e1ci\u00f3s oldal\u00e1n olvashat\u00f3. about:config<\/b> Aktiv\u00e1ljuk a k\u00f6vetkez\u0151 be\u00e1ll\u00edt\u00e1sokat:<\/p>\n

network.trr.mode = 2;\nnetwork.trr.uri = https:\/\/mozilla.cloudflare-dns.com\/dns-query\nnetwork.security.esni.enabled = true\n<\/code><\/pre>\n
Ezut\u00e1n ellen\u0151rizz\u00fck a be\u00e1ll\u00edt\u00e1sok helyess\u00e9g\u00e9t a Cloudflare weboldal\u00e1n a linkre kattintva<\/a> \u00e9s pr\u00f3b\u00e1ljuk meg \u00fajra a tr\u00fckk\u00f6t a torrent tracker\u00fcnkkel.<\/p>\n
\"Domain-frontrendszer<\/p>\n
Voil\u00e0. A kedvenc tracker\u00fcnk megny\u00edlt, b\u00e1rmif\u00e9le VPN \u00e9s proxy szerver n\u00e9lk\u00fcl. N\u00e9zz\u00fck meg most a forgalom dumpj\u00e1t a Wiresharkban, mi is t\u00f6rt\u00e9nt.<\/p>\n
\"Domain-frontrendszer<\/p>\n
Ez\u00fattal az SSL Client Hello csomag nem tartalmazza ny\u00edltan a c\u00e9l domaint, helyette egy \u00faj mez\u0151 jelent meg a csomagban - az encrypted_server_name - itt tal\u00e1lhat\u00f3 a rutracker.nl \u00e9rt\u00e9ke, \u00e9s ezt a mez\u0151t csak a Cloudflare frontend szerver tudja dek\u00f3dolni. \u00cdgy a szolg\u00e1ltat\u00f3 DPI-nek nem marad m\u00e1s v\u00e1laszt\u00e1sa, mint kezeit mosni, \u00e9s enged\u00e9lyezni ezt a forgalmat. M\u00e1s titkos\u00edt\u00e1si lehet\u0151s\u00e9g pedig nem l\u00e9tezik.<\/p>\n
Teh\u00e1t megn\u00e9zt\u00fck, hogyan m\u0171k\u00f6dik a technol\u00f3gia a b\u00f6ng\u00e9sz\u0151ben. Most pr\u00f3b\u00e1ljuk meg alkalmazni ezt specifikusabb \u00e9s \u00e9rdekesebb dolgokra. El\u0151sz\u00f6r is megtan\u00edtjuk a curl-t, hogy haszn\u00e1lja az eSNI-t a TLS 1.3 t\u00e1mogat\u00e1s\u00e1hoz, \u00e9s k\u00f6zben megn\u00e9zz\u00fck, hogyan m\u0171k\u00f6dik az eSNI alap\u00fa domain-fronting.<\/p>\n
Domain-fronting eSNI-vel<\/h3>\n
Mivel a curl a https protokollhoz az openssl szabv\u00e1nyos k\u00f6nyvt\u00e1rat haszn\u00e1lja, el\u0151sz\u00f6r is biztos\u00edtani kell az eSNI t\u00e1mogat\u00e1st ott. Az openssl master-\u00e1g\u00e1ban m\u00e9g nincs eSNI t\u00e1mogat\u00e1s, ez\u00e9rt le kell t\u00f6lten\u00fcnk egy speci\u00e1lis openssl \u00e1gat, le kell ford\u00edtanunk \u00e9s telep\u00edten\u00fcnk kell.<\/p>\n
Kl\u00f3nozzuk a GitHub-t\u00e1rhelyet \u00e9s ford\u00edtsuk le, ahogy azt szoktuk:<\/p>\n
$ git clone https:\/\/github.com\/sftcd\/openssl\n$ cd openssl\n$ .\/config\n\n$ make\n$ cd esnistuff\n$ make\n<\/code><\/pre>\n
Ezut\u00e1n kl\u00f3nozzuk a curl t\u00e1rhelyet, \u00e9s konfigur\u00e1ljuk a ford\u00edt\u00e1st az \u00e1ltalunk ford\u00edtott openssl k\u00f6nyvt\u00e1r haszn\u00e1lat\u00e1val:<\/p>\n
$ cd $HOME\/code\n$ git clone https:\/\/github.com\/niallor\/curl.git curl-esni\n$ cd curl-esni\n\n$ export LD_LIBRARY_PATH=\/opt\/openssl\n$ .\/buildconf\n$ LDFLAGS=\"-L\/opt\/openssl\" .\/configure --with-ssl=\/opt\/openssl --enable-esni --enable-debug\n<\/code><\/pre>\n
Itt fontos, hogy helyesen adjuk meg az openssl \u00f6sszes k\u00f6nyvt\u00e1r\u00e1t (a mi eset\u00fcnkben ez a \/opt\/openssl\/), \u00e9s figyelj\u00fcnk arra, hogy a konfigur\u00e1ci\u00f3s folyamat hiba n\u00e9lk\u00fcl zajlott.<\/p>\n
Sikeres konfigur\u00e1ci\u00f3 eset\u00e9n meg fogjuk l\u00e1tni a k\u00f6vetkez\u0151 sort:<\/p>\n
WARNING: esni ESNI enabled but marked EXPERIMENTAL. Use with caution!<\/b><\/p>\n
$ make<\/code><\/pre>\n
A csomag sikeres \u00f6ssze\u00e1ll\u00edt\u00e1sa ut\u00e1n a curl be\u00e1ll\u00edt\u00e1s\u00e1hoz \u00e9s elind\u00edt\u00e1s\u00e1hoz k\u00fcl\u00f6n bash f\u00e1jlt haszn\u00e1lunk az openssl-b\u0151l. M\u00e1soljuk \u00e1t a curl k\u00f6nyvt\u00e1r\u00e1ba az egyszer\u0171s\u00e9g kedv\u00e9\u00e9rt:<\/p>\n
cp \/opt\/openssl\/esnistuff\/curl-esni <\/code><\/pre>\n
\u00e9s v\u00e9gezz\u00fcnk egy teszt https-k\u00e9r\u00e9st a cloudflare szerver fel\u00e9, mik\u00f6zben r\u00f6gz\u00edtj\u00fck a DNS \u00e9s TLS csomagokat a Wireshark-ban.<\/p>\n
$ ESNI_COVER=\"www.hello-rkn.ru\" .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
A szerver v\u00e1lasz\u00e1ban, az openssl-t\u0151l \u00e9s curl-t\u0151l sz\u00e1rmaz\u00f3 sz\u00e1mos hibakeres\u00e9si inform\u00e1ci\u00f3 mellett, HTTP v\u00e1lasz k\u00f3dot (301) kapunk a cloudflare-t\u0151l.<\/p>\n
HTTP\/1.1 301 Moved Permanently\n<Date: Sun, 03 Nov 2019 13:12:55 GMT\n<Transfer-Encoding: chunked\n<Connection: keep-alive\n<Cache-Control: max-age=3600\n<Expires: Sun, 03 Nov 2019 14:12:55 GMT\n<Location: https:\/\/www.cloudflare.com\/\n<\/code><\/pre>\n
ami arr\u00f3l tan\u00faskodik, hogy a k\u00e9r\u00e9s\u00fcnket sikeresen tov\u00e1bb\u00edtott\u00e1k a c\u00e9l szerverhez, ahol azt meghallgatt\u00e1k \u00e9s feldolgozt\u00e1k.<\/p>\n
Most n\u00e9zz\u00fck meg a Wireshark forgalmi dumpj\u00e1t, azaz mit l\u00e1tott ebben az esetben a szolg\u00e1ltat\u00f3 DPI.<\/p>\n
\"Domain-frontrendszer<\/p>\n
L\u00e1that\u00f3, hogy el\u0151sz\u00f6r a curl a DNS szerverhez fordult a cloudflare publikus eSNI kulcs\u00e1\u00e9rt \u2014 TXT DNS lek\u00e9rdez\u00e9s az _esni.cloudflare.com c\u00edmen (13. csomag). Ezut\u00e1n, az openssl k\u00f6nyvt\u00e1rat haszn\u00e1lva, a curl TLS 1.3 lek\u00e9rdez\u00e9st k\u00fcld\u00f6tt a cloudflare szervernek, amelyben az SNI mez\u0151t a kor\u00e1bban kapott publikus kulccsal titkos\u00edtotta (22. csomag). De az eSNI mez\u0151 mellett a SSL-hello csomagban egy ny\u00edlt SNI mez\u0151 is szerepelt, amit tetsz\u0151leges sorrendben megadhatunk (ebben az esetben \u2014 www.hello-rkn.ru<\/a>). <\/b><\/p>\n
Ez a ny\u00edlt SNI mez\u0151 nem j\u00e1tszott szerepet a cloudflare szerverek \u00e1ltali feldolgoz\u00e1sban, \u00e9s csak a szolg\u00e1ltat\u00f3 DPI el\u0151l val\u00f3 \u00e1lc\u00e1z\u00e1s c\u00e9lj\u00e1ra szolg\u00e1lt. A cloudflare szerver elfogadta az SSL-hello csomagunkat, dek\u00f3dolta az eSNI-t, kinyerte bel\u0151le az eredeti SNI-t, \u00e9s mint ha mi sem t\u00f6rt\u00e9nt volna, feldolgozta (pontosan \u00fagy, ahogy az eSNI fejleszt\u00e9sekor tervezve volt).<\/p>\n
Az egyetlen t\u00e9nyez\u0151, amire ebben az esetben a DPI szempontj\u00e1b\u00f3l lehetne hivatkozni, az az els\u0151dleges DNS k\u00e9r\u00e9s az _esni.cloudflare.com c\u00edmre. De enn\u00e9l a k\u00e9r\u00e9sn\u00e9l a ny\u00edlt DNS lek\u00e9rdez\u00e9st csak az\u00e9rt tett\u00fck, hogy bemutassuk, hogyan m\u0171k\u00f6dik ez a mechanizmus a bels\u0151 r\u00e9szletekben.<\/p>\n
Annak \u00e9rdek\u00e9ben, hogy v\u00e9gleg elt\u00e1vol\u00edtsuk a talajt a DPI l\u00e1ba al\u00f3l, a m\u00e1r megeml\u00edtett DNS-over-HTTPS mechanizmust haszn\u00e1ljuk. Egy kis magyar\u00e1zat \u2013 a DOH \u2013 egy protokoll, amely lehet\u0151s\u00e9get biztos\u00edt a \u201ek\u00f6z\u00e9ps\u0151 ember\u201d t\u00e1mad\u00e1sok ellen, mivel a DNS lek\u00e9rdez\u00e9st HTTPS protokollon kereszt\u00fcl k\u00fcldj\u00fck el.<\/p>\n
Ism\u00e9telj\u00fck meg a lek\u00e9rdez\u00e9st, de ez\u00fattal a publikus eSNI kulcsokat HTTPS protokollon kereszt\u00fcl kapjuk, nem DNS-en:<\/p>\n
ESNI_COVER=\"www.hello-rkn.ru\" DOH_URL=https:\/\/mozilla.cloudflare-dns.com\/dns-query .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
A lek\u00e9rdez\u00e9s forgalm\u00e1nak dumpja az al\u00e1bbi k\u00e9perny\u0151k\u00e9pen l\u00e1that\u00f3:<\/p>\n
\"Domain-frontrendszer<\/p>\n
L\u00e1that\u00f3, hogy el\u0151sz\u00f6r a curl a mozilla.cloudflare-dns.com szerverhez fordul a DoH protokollon (HTTPS kapcsolat a 104.16.249.249 szerverhez), hogy ott megszerezze a SNI titkos\u00edt\u00e1s\u00e1hoz sz\u00fcks\u00e9ges publikus kulcsakat, majd ezt k\u00f6vet\u0151en a c\u00e9lkiszolg\u00e1l\u00f3hoz, mik\u00f6zben a k\u00f6vetkez\u0151 domain m\u00f6g\u00e9 rejt\u0151zik. www.hello-rkn.ru<\/a>.<\/p>\n
A fent eml\u00edtett mozilla.cloudflare-dns.com DoH felold\u00f3 mellett m\u00e1s n\u00e9pszer\u0171 DoH szolg\u00e1ltat\u00e1sokat is haszn\u00e1lhatunk, p\u00e9ld\u00e1ul a h\u00edres gonosz v\u00e1llalatot.
\nHajtsuk v\u00e9gre ezt a lek\u00e9rdez\u00e9st:<\/p>\n
ESNI_COVER=\"www.kremlin.ru\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
\u00c9s v\u00e1laszt kapunk:<\/p>\n
< HTTP\/1.1 301 Moved Permanently\n<Date: Sun, 03 Nov 2019 14:10:22 GMT\n<Content-Type: text\/html\n<Transfer-Encoding: chunked\n<Connection: keep-alive\n<Set-Cookie: __cfduid=da0144d982437e77b0b37af7d00438b1a1572790222; expires=Mon, 02-Nov-20 14:10:22 GMT; path=\/; domain=.rutracker.nl; HttpOnly; Secure\n<Location: https:\/\/rutracker.nl\/forum\/index.php\n<CF-Cache-Status: DYNAMIC\n<Expect-CT: max-age=604800, report-uri="https:\/\/report-uri.cloudflare.com\/cdn-cgi\/beacon\/expect-ct"\n<Server: cloudflare\n<CF-RAY: 52feee696f42d891-CPH\n<\/code><\/pre>\n
\"Domain-frontrendszer<\/p>\n
Ebben az esetben a blokkolt rutracker.nl szerverre \u00e9rkezt\u00fcnk, a DoH-rozolvert dns.google haszn\u00e1lva (itt nincs el\u00edr\u00e1s, most m\u00e1r a h\u00edres v\u00e1llalatnak van saj\u00e1t els\u0151 szint\u0171 domaine) \u00e9s egy m\u00e1sik domain m\u00f6g\u00e9 b\u00fajva, amelynek blokkol\u00e1sa szigor\u00faan tilos minden DPI sz\u00e1m\u00e1ra, hal\u00e1lb\u00fcntet\u00e9s terhe mellett. A kapott v\u00e1laszb\u00f3l meg\u00e9rthetj\u00fck, hogy a k\u00e9r\u00e9s\u00fcnket sikeresen feldolgozt\u00e1k.<\/p>\n
Tov\u00e1bbi ellen\u0151rz\u00e9sk\u00e9nt, hogy a szolg\u00e1ltat\u00f3 DPI reag\u00e1l a nyitott SNI-re, amit fedez\u00e9sk\u00e9nt adunk meg, v\u00e9gezhet\u00fcnk egy k\u00e9r\u00e9st a rutracker.nl-re, elb\u00fajva egy m\u00e1sik, tiltott forr\u00e1st\u00f3l, p\u00e9ld\u00e1ul egy m\u00e1sik \u201ej\u00f3\u201d torrent-tracker m\u00f6g\u00e9:<\/p>\n
$ ESNI_COVER=\"rutor.info\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
A szervert\u0151l v\u00e1laszt nem kapunk, mivel a k\u00e9r\u00e9s\u00fcnket a DPI rendszer blokkolja.<\/p>\n
R\u00f6vid k\u00f6vetkeztet\u00e9s az els\u0151 r\u00e9szhez<\/h3>\n
Teh\u00e1t siker\u00fclt bemutatnunk az eSNI m\u0171k\u00f6d\u00e9s\u00e9t az openssl \u00e9s a curl seg\u00edts\u00e9g\u00e9vel, \u00e9s ellen\u0151rizn\u00fcnk az eSNI-re alapozott domain-fronting m\u0171k\u00f6d\u00e9s\u00e9t. Ilyen m\u00f3don adapt\u00e1lhatjuk kedvenc eszk\u00f6zeinket, amelyek az openssl k\u00f6nyvt\u00e1rat haszn\u00e1lj\u00e1k, hogy \u201em\u00e1s domainok m\u00f6g\u00f6tt\u201d m\u0171k\u00f6djenek. R\u00e9szletek err\u0151l \u2014 a k\u00f6vetkez\u0151 cikkekben.<\/p>\n
Forr\u00e1s: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0442 \u0442\u0430\u043a\u0438\u0445 \u0438\u043c\u0435\u043d\u0438\u0442\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043a\u0430\u043a Cisco, BlueCoat, FireEye \u0438\u043c\u0435\u044e\u0442 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043c\u043e\u0449\u043d\u044b\u043c\u0438 \u0438\u0445 \u0441\u043e\u0431\u0440\u0430\u0442\u044c\u044f\u043c\u0438 \u2014 DPI \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0438\u043b\u0435\u043d\u043d\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435. \u0421\u0443\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0442\u0435\u0445 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0434\u043e\u0441\u043c\u043e\u0442\u0440 \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u043d\u044b\u0445\/\u0431\u0435\u043b\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432, \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52639","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47TLS 1.3 alap\u00fa domain-fronting | ProHoster","description":"Bevezet\u00e9s A modern v\u00e1llalati sz\u0171r\u0151rendszerek.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3 | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2026-05-20T17:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52639","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:27","updated":"2026-01-24 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/52639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=52639"}],"version-history":[{"count":3,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/52639\/revisions"}],"predecessor-version":[{"id":173323,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/52639\/revisions\/173323"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=52639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=52639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=52639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}