{"id":52639,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/domen-fronting-na-baze-tls-1-3"},"modified":"2026-05-20T19:54:20","modified_gmt":"2026-05-20T17:54:20","slug":"domen-fronting-na-baze-tls-1-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","title":{"rendered":"TLS 1.3 b\u0101zes dom\u0113na fronting","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ievads<\/h3>\n

\"TLS
\nM\u016bsdienu korporat\u012bv\u0101s satura filtr\u0113\u0161anas sist\u0113mas, no t\u0101diem izcilu ra\u017eot\u0101ju k\u0101 Cisco, BlueCoat, FireEye, ir diezgan l\u012bdz\u012bgas saviem jaud\u012bg\u0101kajiem radiniekiem \u2014 DPI sist\u0113m\u0101m, kas akt\u012bvi tiek ieviestas valsts l\u012bmen\u012b. To darb\u012bbas b\u016bt\u012bba ir p\u0101rbaud\u012bt ien\u0101ko\u0161\u0101 un izejo\u0161\u0101 interneta trafika saturu un, pamatojoties uz melnajiem\/baltajiem sarakstiem, pie\u0146emt l\u0113mumu par interneta savienojuma aizlieg\u0161anu. T\u0101 k\u0101 abas sist\u0113mas balst\u0101s uz l\u012bdz\u012bgiem principiem, ar\u012b veidi, k\u0101 tos apiet, b\u016bs l\u012bdz\u012bgi.<\/p>\n

Viena no tehnolo\u0123ij\u0101m, kas \u013cauj pietiekami efekt\u012bvi apiet gan DPI, gan korporat\u012bv\u0101s sist\u0113mas, ir dom\u0113nu frontinga tehnolo\u0123ija. T\u0101s b\u016bt\u012bba ir t\u0101da, ka m\u0113s piek\u013c\u016bstam blo\u0137\u0113tajai vietnei, sl\u0113pjoties aiz cita, publiska dom\u0113na ar labu reput\u0101ciju, kas noteikti netiks blo\u0137\u0113ts nevien\u0101 sist\u0113m\u0101, piem\u0113ram, google.com.<\/p>\n

Par \u0161o tehnolo\u0123iju jau ir uzrakst\u012bts pietiekami daudz rakstu un sniegti daudzi piem\u0113ri. Tom\u0113r popul\u0101r\u0101s un p\u0113d\u0113j\u0101 laik\u0101 apspriest\u0101s tehnolo\u0123ijas DNS-over-HTTPS un encrypted-SNI, k\u0101 ar\u012b jaun\u0101 TLS 1.3 protokola versija sniedz iesp\u0113ju apsv\u0113rt v\u0113l vienu dom\u0113nu frontinga variantu.
\n<\/a><\/p>\n

Izprotam tehnolo\u0123iju<\/h3>\n

Vispirms nedaudz noteiksim pamata j\u0113dzienus, lai visiem b\u016btu skaidrs, kas ir kas un k\u0101p\u0113c tas viss ir nepiecie\u0161ams. M\u0113s piemin\u0113j\u0101m eSNI meh\u0101nismu, kura darb\u012bba tiks apskat\u012bta t\u0101l\u0101k. eSNI (enkript\u0113ta Servera V\u0101rda Nor\u0101de) ir aizsarg\u0101ta SNI versija, kas pieejama tikai TLS 1.3 protokolam. Galven\u0101 b\u016bt\u012bba ir \u0161ifr\u0113t ar\u012b inform\u0101ciju par to, uz kuru dom\u0113nu tiek s\u016bt\u012bts piepras\u012bjums.<\/p>\n

Tagad apskat\u012bsim eSNI meh\u0101nisma darb\u012bbu praks\u0113.<\/p>\n

Pie\u0146emsim, ka mums ir interneta resurss, kas tiek blo\u0137\u0113ts ar m\u016bsdienu DPI risin\u0101jumu (\u0146emot v\u0113r\u0101 paz\u012bstamo torrentu izseko\u0161anas pakalpojumu \u2014 rutracker.nl). M\u0113\u0123inot piek\u013c\u016bt torrentu izseko\u0161anas vietnei \u2014 m\u0113s redzam standarta pakalpojumu sniedz\u0113ja pazi\u0146ojumu par to, ka resurss tiek blo\u0137\u0113ts:<\/p>\n

\"TLS<\/p>\n

RKD m\u0101jaslap\u0101 \u0161is dom\u0113ns patie\u0161\u0101m ir iek\u013cauts melnaj\u0101 sarakst\u0101:<\/p>\n

\"TLS<\/p>\n

Veicot whois piepras\u012bjumu \u2014 redzams, ka pats dom\u0113ns ir \"pasl\u0113pts\" aiz m\u0101ko\u0146u pakalpojumu sniedz\u0113ja Cloudflare.<\/p>\n

\"TLS<\/p>\n

Ta\u010du at\u0161\u0137ir\u012bb\u0101 no \u00abspeci\u0101listiem\u00bb no RKN, tehniski zino\u0161ie darbinieki no Biti (vai m\u0101c\u012bju\u0161ies no m\u016bsu slaven\u0101 regulatora r\u016bgt\u0101s pieredzes) nes\u0101ka akli blo\u0137\u0113t vietni p\u0113c IP adreses, bet iek\u013c\u0101va stop-list\u0113 tie\u0161i dom\u0113na nosaukumu<\/a>. To ir viegli p\u0101rliecin\u0101ties, ja paskat\u0101s, k\u0101di v\u0113l dom\u0113ni sl\u0113pjas aiz \u0161\u012b pa\u0161a IP adresi<\/a>, apmekl\u0113jiet k\u0101du no tiem un redziet, ka piek\u013cuve nav blo\u0137\u0113ta:<\/p>\n

\"TLS<\/p>\n

K\u0101 tas visp\u0101r notiek? K\u0101 pakalpojumu sniedz\u0113ja DPI uzzina, uz kuru no dom\u0113niem iet mans p\u0101rl\u016bks, ja visi sakari notiek, izmantojot https protokolu, un m\u0113s, \u0161\u0137iet, v\u0113l neesam paman\u012bju\u0161i Bites sertifik\u0101tu aizvieto\u0161anas? Vai vi\u0146\u0161 nav gai\u0161re\u0123is vai k\u0101ds mani nov\u0113ro?<\/p>\n

M\u0113\u0123in\u0101sim atbild\u0113t uz \u0161o jaut\u0101jumu, apl\u016bkojot trafiku caur Wireshark<\/p>\n

\"TLS<\/p>\n

Ekr\u0101nuz\u0146\u0113mum\u0101 redzams, ka vispirms p\u0101rl\u016bks sa\u0146em servera IP adresi caur DNS, p\u0113c tam notiek standarta TCP roku spiediens ar m\u0113r\u0137a serveri, un tad p\u0101rl\u016bks m\u0113\u0123ina izveidot SSL savienojumu ar serveri. Lai to izdar\u012btu, vi\u0146\u0161 p\u0101rs\u016bta paketi SSL<\/a> Client Hello, kur\u0101 atkl\u0101t\u0101 veid\u0101 ir iek\u013cauts avota dom\u0113na nosaukums. \u0160is lauks ir nepiecie\u0161ams frontend serverim Cloudflare, lai pareizi mar\u0161rut\u0113tu savienojumu. Tie\u0161i \u0161eit m\u016bs no\u0137er pakalpojumu sniedz\u0113ja DPI, p\u0101rtraucot m\u016bsu savienojumu. M\u0113s nesa\u0146emam no pakalpojumu sniedz\u0113ja nek\u0101du aizvieto\u0161anas zi\u0146u un redzam standarta p\u0101rl\u016bka k\u013c\u016bdu, it k\u0101 vietne b\u016btu izsl\u0113gta vai vienk\u0101r\u0161i nedarbotos:<\/p>\n

\"TLS<\/p>\n

Tagad \u013caujiet iesl\u0113gt eSNI meh\u0101nismu p\u0101rl\u016bk\u0101, k\u0101 nor\u0101d\u012bts instrukcij\u0101 Firefox <\/a>:
\nT\u0101d\u0113j\u0101di m\u0113s atveram Firefox konfigur\u0101cijas lapu about:config<\/b> un aktiviz\u0113jam \u0161\u0101das opcijas:<\/p>\n

network.trr.mode = 2;\nnetwork.trr.uri = https:\/\/mozilla.cloudflare-dns.com\/dns-query\nnetwork.security.esni.enabled = true\n<\/code><\/pre>\n
P\u0113c tam m\u0113s p\u0101rbaud\u012bsim iestat\u012bjumu pareizu darbu vietn\u0113 Cloudflare, sai\u0161u<\/a> un v\u0113lreiz m\u0113\u0123in\u0101sim triku ar m\u016bsu torrentu izsekot\u0101ju.<\/p>\n
\"TLS<\/p>\n
Voil\u00e0. M\u016bsu m\u012b\u013cotais izsekot\u0101js ir atv\u0113rts, bez jebk\u0101diem VPN un starpniekserveriem. Tagad apl\u016bkosim trafika dumpu Wireshark, kas tad notika.<\/p>\n
\"TLS<\/p>\n
\u0160oreiz pakete SSL Client Hello nesatur atkl\u0101ti m\u0113r\u0137a dom\u0113nu, bet t\u0101 viet\u0101 paketes sast\u0101v\u0101 ir jauns lauks \u2014 encrypted_server_name \u2014 tie\u0161i tur ir iek\u013cauta v\u0113rt\u012bba rutracker.nl, un \u0161o lauku var at\u0161ifr\u0113t tikai Cloudflare frontend serveris. Ja t\u0101 ir, pakalpojumu sniedz\u0113ja DPI paliek ar neko citu k\u0101 mazg\u0101t rokas un at\u013caut \u0161\u0101du trafiku. Un nav citu iesp\u0113ju \u0161ifr\u0113\u0161anai.<\/p>\n
T\u0101tad, k\u0101 tehnolo\u0123ija darbojas p\u0101rl\u016bk\u0101 \u2014 m\u0113s esam noskaidroju\u0161i. Tagad m\u0113\u0123in\u0101sim to pielietot specifisk\u0101k un interesant\u0101k. S\u0101ksim ar to, ka iem\u0101c\u012bsim curl izmantot eSNI, lai str\u0101d\u0101tu ar TLS 1.3, un vienlaikus apskat\u012bsim pa\u0161u dom\u0113na frontingu, kas balst\u012bts uz eSNI.<\/p>\n
Dom\u0113na frontings ar eSNI<\/h3>\n
\u0145emot v\u0113r\u0101, ka curl HTTPS savienojumiem izmanto standartiz\u0113tu openssl bibliot\u0113ku, pirmk\u0101rt, mums j\u0101p\u0101rliecin\u0101s, ka eSNI atbalsts ir nodro\u0161in\u0101ts tie\u0161i tur. Parastaj\u0101s openssl sazarojumos eSNI atbalsts pagaid\u0101m nav, t\u0101p\u0113c mums ir j\u0101lejupiel\u0101d\u0113 \u012bpa\u0161s openssl sazarojums, j\u0101kompil\u0113 un j\u0101instal\u0113 tas.<\/p>\n
Klon\u0113jam repozitoriju no GitHub un kompil\u0113jam k\u0101 parasti:<\/p>\n
$ git clone https:\/\/github.com\/sftcd\/openssl\n$ cd openssl\n$ .\/config\n\n$ make\n$ cd esnistuff\n$ make\n<\/code><\/pre>\n
T\u0101l\u0101k \u2014 klon\u0113jam curl repozitoriju un konfigur\u0113jam t\u0101 kompil\u0101ciju, izmantojot m\u016bsu sagr\u0101bto openssl bibliot\u0113ku:<\/p>\n
$ cd $HOME\/code\n$ git clone https:\/\/github.com\/niallor\/curl.git curl-esni\n$ cd curl-esni\n\n$ export LD_LIBRARY_PATH=\/opt\/openssl\n$ .\/buildconf\n$ LDFLAGS=\"-L\/opt\/openssl\" .\/configure --with-ssl=\/opt\/openssl --enable-esni --enable-debug\n<\/code><\/pre>\n
\u0160eit ir svar\u012bgi pareizi nor\u0101d\u012bt visus katalogus, kuros atrodas openssl (m\u016bsu gad\u012bjum\u0101 \u2014 t\u0101 ir \/opt\/openssl\/) un p\u0101rliecin\u0101ties, ka konfigur\u0101cijas process ir norit\u0113jis bez k\u013c\u016bd\u0101m.<\/p>\n
Veiksm\u012bgas konfigur\u0101cijas gad\u012bjum\u0101 m\u0113s redz\u0113sim rindu:<\/p>\n
WARNING: esni ESNI atbalsts ir iesp\u0113jots, bet tas ir atz\u012bm\u0113ts k\u0101 EKSPERIMENT\u0100LS. Lietojiet ar piesardz\u012bbu!<\/b><\/p>\n
$ make<\/code><\/pre>\n
P\u0113c veiksm\u012bgas paketa kompil\u0113\u0161anas m\u0113s izmantosim \u012bpa\u0161u bash failu no openssl komplekta, lai konfigur\u0113tu un palaistu curl. Nokop\u0113sim to curl katalog\u0101 \u0113rt\u012bbas labad:<\/p>\n
cp \/opt\/openssl\/esnistuff\/curl-esni <\/code><\/pre>\n
un veiksim testa https piepras\u012bjumu uz cloudflare serveri, vienlaikus ierakstot DNS un TLS paketes programm\u0101 Wireshark.<\/p>\n
$ ESNI_COVER=\"www.hello-rkn.ru\" .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
Servera atbild\u0113, papildus daudz\u0101m diagnostikas inform\u0101cij\u0101m no openssl un curl, m\u0113s sa\u0146emsim HTTP atbildi ar kodu 301 no cloudflare.<\/p>\n
HTTP\/1.1 301 Moved Permanently\n< Date: Sun, 03 Nov 2019 13:12:55 GMT\n< Transfer-Encoding: chunked\n< Connection: keep-alive\n< Cache-Control: max-age=3600\n< Expires: Sun, 03 Nov 2019 14:12:55 GMT\n< Location: https:\/\/www.cloudflare.com\/\n<\/code><\/pre>\n
kas liecina par to, ka m\u016bsu piepras\u012bjums ir veiksm\u012bgi nog\u0101d\u0101ts l\u012bdz m\u0113r\u0137a serverim, dzird\u0113ts un apstr\u0101d\u0101ts.<\/p>\n
Tagad apl\u016bkosim trafika piepl\u016bduma dump\u0101 Wireshark, proti, ko \u0161aj\u0101 gad\u012bjum\u0101 redz\u0113ja pakalpojumu sniedz\u0113ja DPI.<\/p>\n
\"TLS<\/p>\n
Redzams, ka vispirms curl v\u0113rs\u0101s pie DNS servera p\u0113c publiskajiem eSNI atsl\u0113g\u0101m Cloudflare serverim \u2014 TXT DNS piepras\u012bjums uz _esni.cloudflare.com (pakets Nr. 13). P\u0113c tam, izmantojot openssl bibliot\u0113ku, curl nos\u016bt\u012bja TLS 1.3 piepras\u012bjumu Cloudflare serverim, kur\u0101 SNI lauks bija \u0161ifr\u0113ts ar publisko atsl\u0113gu, kas ieg\u016bta iepriek\u0161\u0113j\u0101 posm\u0101 (pakets Nr. 22). Tom\u0113r, papildus eSNI laukam, SSL-hello paketes sast\u0101v\u0101 tika ievietots ar\u012b lauks ar parasto \u2014 atkl\u0101to SNI, kuru m\u0113s varam nor\u0101d\u012bt jebkur\u0101 sec\u012bb\u0101 (\u0161aj\u0101 gad\u012bjum\u0101 \u2014 www.hello-rkn.ru<\/a>). <\/b><\/p>\n
\u0160is atkl\u0101t\u0101 SNI lauks netika \u0146emts v\u0113r\u0101 Cloudflare serveru apstr\u0101d\u0113 un tikai kalpoja par mask\u0113\u0161an\u0101s l\u012bdzekli pakalpojumu sniedz\u0113ja DPI. Cloudflare serveris pie\u0146\u0113ma m\u016bsu ssl-hello paketi, at\u0161ifr\u0113ja eSNI, izc\u0113la no t\u0101 ori\u0123in\u0101lo SNI un apstr\u0101d\u0101ja to, it k\u0101 nekas neb\u016btu noticis (veikta tie\u0161i t\u0101 k\u0101 pl\u0101nots eSNI izstr\u0101d\u0113).<\/p>\n
Vien\u012bgais, pie k\u0101 \u0161aj\u0101 gad\u012bjum\u0101 var pie\u0137erties no DPI viedok\u013ca \u2014 prim\u0101rais DNS piepras\u012bjums uz _esni.cloudflare.com. Bet m\u0113s izdar\u012bj\u0101m DNS piepras\u012bjumu atkl\u0101tu tikai, lai par\u0101d\u012btu, k\u0101 \u0161is meh\u0101nisms darbojas no iek\u0161puses.<\/p>\n
Lai piln\u012bb\u0101 izsist DPI zemi no k\u0101j\u0101m, m\u0113s izmantojam iepriek\u0161 min\u0113to DNS-over-HTTPS meh\u0101nismu. Mazs paskaidrojums \u2014 DOH \u2014 protokols, kas \u013cauj pasarg\u0101t no \"vidus v\u012bra\" uzbrukuma, nos\u016btot DNS piepras\u012bjumu pa HTTPS protokolu.<\/p>\n
Veiksim piepras\u012bjumu atk\u0101rtoti, bet tagad publiskos eSNI atsl\u0113gas m\u0113s ieg\u016bsim pa https protokolu, nevis DNS:<\/p>\n
ESNI_COVER=\"www.hello-rkn.ru\" DOH_URL=https:\/\/mozilla.cloudflare-dns.com\/dns-query .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
Piepras\u012bjuma datu dumps ir att\u0113lots ekr\u0101nuz\u0146\u0113mum\u0101 zem\u0101k:<\/p>\n
\"TLS<\/p>\n
Redzams, ka vispirms curl v\u0113r\u0161as pie servera mozilla.cloudflare-dns.com pa DoH protokolu (HTTPS savienojums ar serveri 104.16.249.249), lai no vi\u0146iem ieg\u016btu publisko atsl\u0113gu v\u0113rt\u012bbas SNI \u0161ifr\u0113\u0161anai, un tikai p\u0113c tam uz m\u0113r\u0137a serveri, aizkl\u0101joties ar dom\u0113nu. www.hello-rkn.ru<\/a>.<\/p>\n
Papildus iepriek\u0161 min\u0113tajam DoH risin\u0101t\u0101jam mozilla.cloudflare-dns.com, m\u0113s varam izmantot ar\u012b citas popul\u0101ras DoH pakalpojumu iesp\u0113jas, piem\u0113ram, no slaven\u0101s \u013caun\u0101s korpor\u0101cijas.
\nVeiksim t\u0101du piepras\u012bjumu:<\/p>\n
ESNI_COVER=\"www.kremlin.ru\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
Un ieg\u016bsim atbildi:<\/p>\n
< HTTP\/1.1 301 Moved Permanently\n<Date: Sun, 03 Nov 2019 14:10:22 GMT\n<Content-Type: text\/html\n<Transfer-Encoding: chunked\n<Connection: keep-alive\n<Set-Cookie: __cfduid=da0144d982437e77b0b37af7d00438b1a1572790222; expires=Mon, 02-Nov-20 14:10:22 GMT; path=\/; domain=.rutracker.nl; HttpOnly; Secure\n<Location: https:\/\/rutracker.nl\/forum\/index.php\n<CF-Cache-Status: DYNAMIC\n<Expect-CT: max-age=604800, report-uri="https:\/\/report-uri.cloudflare.com\/cdn-cgi\/beacon\/expect-ct"\n<Server: cloudflare\n<CF-RAY: 52feee696f42d891-CPH\n<\/code><\/pre>\n
\"TLS<\/p>\n
\u0160aj\u0101 gad\u012bjum\u0101 m\u0113s esam sazin\u0101ju\u0161ies ar blo\u0137\u0113to serveri rutracker.nl, izmantojot DoH resolver dns.google (\u0161eit nav drukas k\u013c\u016bdas, tagad slavenajai korpor\u0101cijai ir savs augst\u0101k\u0101 l\u012bme\u0146a dom\u0113ns) un pasl\u0113pu\u0161ies aiz cita dom\u0113na, kuru blo\u0137\u0113t ir absol\u016bti aizliegts visiem DPI zem n\u0101ves soda draudiem. P\u0113c sa\u0146emt\u0101 atbildes var saprast, ka m\u016bsu piepras\u012bjums tika veiksm\u012bgi apstr\u0101d\u0101ts.<\/p>\n
K\u0101 papildu p\u0101rbaudi tam, ka pakalpojumu sniedz\u0113ja DPI rea\u0123\u0113 uz atv\u0113rtu SNI, ko m\u0113s nododam k\u0101 mask\u0113\u0161anu \u2014 m\u0113s varam veikt piepras\u012bjumu uz rutracker.nl, mask\u0113joties aiz k\u0101da cita blo\u0137\u0113ta resursa, piem\u0113ram, cita \u201elab\u0101\u201d torrentu izseko\u0161anas.<\/p>\n
$ ESNI_COVER=\"rutor.info\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
No servera m\u0113s nesa\u0146emsim atbildi, jo m\u016bsu piepras\u012bjums tiks blo\u0137\u0113ts DPI sist\u0113mas.<\/p>\n
Neliels secin\u0101jums par pirmo da\u013cu<\/h3>\n
T\u0101tad, mums izdev\u0101s demonstr\u0113t eSNI darb\u012bbu, izmantojot openssl un curl, un p\u0101rbaud\u012bt dom\u0113na mask\u0113\u0161anas, kas balst\u012bta uz eSNI, darb\u012bbu. L\u012bdz\u012bg\u0101 veid\u0101 m\u0113s varam piel\u0101got savus iecien\u012bt\u0101kos r\u012bkus, kas izmanto openssl bibliot\u0113ku, darbam \u201ep\u0113c maskas\u201d citiem dom\u0113niem. S\u012bk\u0101k par to \u2014 m\u016bsu n\u0101kamajos rakstos.<\/p>\n
Avots: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0442 \u0442\u0430\u043a\u0438\u0445 \u0438\u043c\u0435\u043d\u0438\u0442\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043a\u0430\u043a Cisco, BlueCoat, FireEye \u0438\u043c\u0435\u044e\u0442 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043c\u043e\u0449\u043d\u044b\u043c\u0438 \u0438\u0445 \u0441\u043e\u0431\u0440\u0430\u0442\u044c\u044f\u043c\u0438 \u2014 DPI \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0438\u043b\u0435\u043d\u043d\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435. \u0421\u0443\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0442\u0435\u0445 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0434\u043e\u0441\u043c\u043e\u0442\u0440 \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u043d\u044b\u0445\/\u0431\u0435\u043b\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432, \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52639","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dom\u0113na mask\u0113\u0161ana, balst\u012bta uz TLS 1.3 | ProHoster","description":"Ievads M\u016bsdienu korporat\u012bv\u0101s filtr\u0101cijas sist\u0113mas.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3 | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2026-05-20T17:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52639","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:27","updated":"2026-01-24 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/52639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=52639"}],"version-history":[{"count":3,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/52639\/revisions"}],"predecessor-version":[{"id":173323,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/52639\/revisions\/173323"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=52639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=52639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=52639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}