{"id":52639,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/domen-fronting-na-baze-tls-1-3"},"modified":"2026-05-20T19:54:20","modified_gmt":"2026-05-20T17:54:20","slug":"domen-fronting-na-baze-tls-1-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","title":{"rendered":"Domain fronting bazat pe TLS 1.3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Introducere<\/h3>\n

\"Domain
\nSistemele moderne de filtrare a con\u021binutului pentru \u00eentreprinderi, de la produc\u0103tori renumi\u021bi precum Cisco, BlueCoat, FireEye, au multe asem\u0103n\u0103ri cu omologii lor mai puternici \u2014 sistemele DPI, care sunt intens implementate la nivel na\u021bional. Esen\u021ba acestei lucr\u0103ri, at\u00e2t pentru unii, c\u00e2t \u0219i pentru al\u021bii, este de a inspecta traficul internetului de intrare \u0219i ie\u0219ire \u0219i, pe baza listelor negre\/glezi albe, a decide asupra interzicerii conexiunii la internet. \u0218i, av\u00e2nd \u00een vedere c\u0103 ambele se bazeaz\u0103 pe principii similare, metodele de ocolire a acestora vor avea, de asemenea, multe \u00een comun.<\/p>\n

Una dintre tehnologiile care permite ocolirea destul de eficient\u0103 at\u00e2t a DPI-ului, c\u00e2t \u0219i a sistemelor corporate, este tehnologia domain-fronting. Esen\u021ba acesteia const\u0103 \u00een faptul c\u0103 acces\u0103m o resurs\u0103 blocat\u0103, ascunz\u00e2ndu-ne \u00een spatele unui alt domeniu public, cu o reputa\u021bie bun\u0103, care nu va fi niciodat\u0103 blocat de vreo sistem, de exemplu google.com.<\/p>\n

S-au scris deja destule articole despre aceast\u0103 tehnologie \u0219i s-au adus multe exemple. Cu toate acestea, tehnologiile populare \u0219i discutate recent DNS-over-HTTPS \u0219i encrypted-SNI, precum \u0219i noua versiune a protocolului TLS 1.3 ofer\u0103 posibilitatea de a lua \u00een considerare \u00eenc\u0103 o variant\u0103 de domain-fronting.
\n<\/a><\/p>\n

S\u0103 ne familiariz\u0103m cu tehnologia<\/h3>\n

La \u00eenceput, s\u0103 ne clarific\u0103m unele concepte de baz\u0103, astfel \u00eenc\u00e2t toat\u0103 lumea s\u0103 \u00een\u021beleag\u0103 cine este cine \u0219i de ce este totul necesar. Am men\u021bionat mecanismul eSNI, al c\u0103rui func\u021bionare va fi discutat\u0103 mai departe. Mecanismul eSNI (encrypted Server Name Indication) \u2013 o variant\u0103 securizat\u0103 a SNI, disponibil\u0103 doar pentru protocolul TLS 1.3. Esen\u021ba principal\u0103 \u2013 criptarea, printre altele, a informa\u021biilor despre domeniul c\u0103tre care este trimis\u0103 cererea.<\/p>\n

Acum s\u0103 analiz\u0103m \u00een practic\u0103 func\u021bionarea mecanismului eSNI.<\/p>\n

Presupunem c\u0103 avem o resurs\u0103 internet care este blocat\u0103 de o solu\u021bie DPI modern\u0103 (s\u0103 lu\u0103m ca exemplu celebrul tracker de torrente \u2014 rutracker.nl). C\u00e2nd \u00eencerc\u0103m s\u0103 acces\u0103m site-ul tracker-ului de torrente \u2014 vedem mesajul standard de interzicere al providerului, care indic\u0103 faptul c\u0103 resursa este blocat\u0103:<\/p>\n

\"Domain<\/p>\n

Pe site-ul RKN, acest domeniu este \u00eentr-adev\u0103r listat pe listele de blocare:<\/p>\n

\"Domain<\/p>\n

La cererea whois \u2014 se poate observa c\u0103 domeniul \u00een sine este \"ascuns\" \u00een spatele providerului cloud Cloudflare.<\/p>\n

\"Domain<\/p>\n

Dar, spre deosebire de \"speciali\u0219tii\" din RKN, angaja\u021bii din Beeline, mai bine preg\u0103ti\u021bi tehnic (sau \u00eenv\u0103\u021ba\u021bi din experien\u021ba amar\u0103 a celebrului nostru regulator), nu au blocat pur \u0219i simplu site-ul dup\u0103 adresa IP, ci l-au inclus \u00een lista de blocare exact pe numele de domeniu<\/a>. Este u\u0219or de verificat, dac\u0103 ne uit\u0103m ce alte domenii se ascund \u00een spatele acestuia adresa IP<\/a>, vizit\u0103m unul dintre ele \u0219i vedem c\u0103 accesul nu este blocat:<\/p>\n

\"Domain<\/p>\n

Cum este posibil a\u0219a ceva? Cum \u0219tie DPI-ul providerului pe care dintre domenii navigheaz\u0103 browserul meu, av\u00e2nd \u00een vedere c\u0103 toate comunica\u021biile se desf\u0103\u0219oar\u0103 prin protocolul https, iar substituirea certificatelor https de c\u0103tre Beeline nu a fost observat\u0103 p\u00e2n\u0103 acum? Oare este vorba de fa\u021bad\u0103 sau cineva m\u0103 urm\u0103re\u0219te?<\/p>\n

S\u0103 \u00eencerc\u0103m s\u0103 r\u0103spundem la aceast\u0103 \u00eentrebare, arunc\u00e2nd o privire asupra traficului prin wireshark<\/p>\n

\"Domain<\/p>\n

\u00cen captura de pe ecran se vede c\u0103, mai \u00eent\u00e2i, browserul prime\u0219te adresa IP a serverului prin DNS, apoi are loc procesul standard de handshake TCP cu serverul de destina\u021bie, iar apoi browserul \u00eencearc\u0103 s\u0103 stabileasc\u0103 o conexiune ssl cu serverul. Pentru aceasta, trimite un pachet SSL<\/a> Client Hello, care con\u021bine numele domeniului surs\u0103 \u00een format deschis. Acest c\u00e2mp este necesar serverului frontend cloudflare pentru a putea ruteze corespunz\u0103tor conexiunea. Aici ne prinde DPI-ul providerului, \u00eentrerup\u00e2nd conexiunea. \u00cen acest timp, nu primim niciun mesaj de eroare de la provider \u0219i vedem o eroare standard a browserului, ca \u0219i cum site-ul ar fi dezactivat sau pur \u0219i simplu nu func\u021bioneaz\u0103:<\/p>\n

\"Domain<\/p>\n

Acum s\u0103 activ\u0103m mecanismul eSNI \u00een browser, a\u0219a cum este descris \u00een instruc\u021biunile pentru Firefox <\/a>:
\nPentru aceasta, deschidem pagina de configurare Firefox about:config<\/b> \u0219i activ\u0103m urm\u0103toarele set\u0103ri:<\/p>\n

network.trr.mode = 2;\nnetwork.trr.uri = https:\/\/mozilla.cloudflare-dns.com\/dns-query\nnetwork.security.esni.enabled = true\n<\/code><\/pre>\n
Dup\u0103 aceasta, vom verifica corectitudinea func\u021bion\u0103rii set\u0103rilor pe site-ul cloudflare la linkul<\/a> \u0219i vom \u00eencerca din nou trucul cu tracker-ul nostru de torrent.<\/p>\n
\"Domain<\/p>\n
Voil\u00e0. Tracker-ul nostru favorit s-a deschis, f\u0103r\u0103 VPN-uri sau servere proxy. S\u0103 arunc\u0103m acum o privire asupra dump-ului de trafic \u00een wireshark, ce s-a \u00eent\u00e2mplat.<\/p>\n
\"Domain<\/p>\n
De data aceasta, pachetul ssl client hello nu con\u021bine \u00een mod explicit domeniul de destina\u021bie, iar \u00een schimb a ap\u0103rut un nou c\u00e2mp - encrypted_server_name - acesta con\u021bine valoarea rutracker.nl, iar decriptarea acestui c\u00e2mp poate fi realizat\u0103 doar de serverul frontend cloudflare. Iar, \u00een acest caz, DPI-ul providerului nu are alt\u0103 op\u021biune dec\u00e2t s\u0103 se spele pe m\u00e2ini \u0219i s\u0103 permit\u0103 acest tip de trafic. \u0218i nu exist\u0103 alte op\u021biuni de criptare.<\/p>\n
Deci, cum func\u021bioneaz\u0103 tehnologia \u00een browser \u2014 am v\u0103zut. Acum s\u0103 \u00eencerc\u0103m s\u0103 o aplic\u0103m pentru lucruri mai specifice \u0219i interesante. Pentru \u00eenceput, vom \u00eenv\u0103\u021ba cum s\u0103 folosim aceea\u0219i comanda curl cu eSNI pentru a lucra cu TLS 1.3, \u0219i \u00een acela\u0219i timp vom explora cum func\u021bioneaz\u0103 frontarea domeniului bazat\u0103 pe eSNI.<\/p>\n
Frontarea domeniului cu eSNI<\/h3>\n
Av\u00e2nd \u00een vedere c\u0103 curl folose\u0219te biblioteca standard openssl pentru a se conecta prin protocolul https, trebuie s\u0103 ne asigur\u0103m \u00eent\u00e2i c\u0103 eSNI este suportat acolo. \u00cen ramurile master ale openssl, suportul pentru eSNI nu este \u00eenc\u0103 disponibil, a\u0219a c\u0103 trebuie s\u0103 desc\u0103rc\u0103m o ramur\u0103 special\u0103 openssl, s\u0103 o compil\u0103m \u0219i s\u0103 o instal\u0103m.<\/p>\n
Clon\u0103m repository-ul de pe GitHub \u0219i \u00eel compil\u0103m ca de obicei:<\/p>\n
$ git clone https:\/\/github.com\/sftcd\/openssl\n$ cd openssl\n$ .\/config\n\n$ make\n$ cd esnistuff\n$ make\n<\/code><\/pre>\n
Apoi, clon\u0103m repository-ul curl \u0219i configur\u0103m compilarea utiliz\u00e2nd biblioteca noastr\u0103 openssl compilat\u0103:<\/p>\n
$ cd $HOME\/code\n$ git clone https:\/\/github.com\/niallor\/curl.git curl-esni\n$ cd curl-esni\n\n$ export LD_LIBRARY_PATH=\/opt\/openssl\n$ .\/buildconf\n$ LDFLAGS=\"-L\/opt\/openssl\" .\/configure --with-ssl=\/opt\/openssl --enable-esni --enable-debug\n<\/code><\/pre>\n
Este important s\u0103 specific\u0103m corect toate directoarele \u00een care se afl\u0103 openssl (\u00een cazul nostru \u2014 este \/opt\/openssl\/) \u0219i s\u0103 ne asigur\u0103m c\u0103 procesul de configurare s-a desf\u0103\u0219urat f\u0103r\u0103 erori.<\/p>\n
\u00cen cazul unei configur\u0103ri reu\u0219ite \u2014 vom vedea linia:<\/p>\n
WARNING: esni ESNI enabled but marked EXPERIMENTAL. Use with caution!<\/b><\/p>\n
$ make<\/code><\/pre>\n
Dup\u0103 compilarea cu succes a pachetului, vom folosi un fi\u0219ier bash special din pachetul openssl pentru a configura \u0219i a rula curl. \u00cel vom copia \u00een directorul cu curl pentru comoditate:<\/p>\n
cp \/opt\/openssl\/esnistuff\/curl-esni <\/code><\/pre>\n
\u0219i vom efectua o cerere https de testare c\u0103tre serverul cloudflare, \u00een acela\u0219i timp \u00eenregistr\u00e2nd pachetele DNS \u0219i TLS \u00een Wireshark.<\/p>\n
$ ESNI_COVER=\"www.hello-rkn.ru\" .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
\u00cen r\u0103spunsul serverului, pe l\u00e2ng\u0103 multitudinea de informa\u021bii de depanare de la openssl \u0219i curl, vom primi un r\u0103spuns HTTP cu codul 301 de la cloudflare.<\/p>\n
HTTP\/1.1 301 Moved Permanently\n<Date: Sun, 03 Nov 2019 13:12:55 GMT\n<Transfer-Encoding: chunked\n<Connection: keep-alive\n<Cache-Control: max-age=3600\n<Expires: Sun, 03 Nov 2019 14:12:55 GMT\n<Location: https:\/\/www.cloudflare.com\/\n<\/code><\/pre>\n
ceea ce indic\u0103 faptul c\u0103 cererea noastr\u0103 a fost livrat\u0103 cu succes c\u0103tre serverul de destina\u021bie, a fost auzit\u0103 \u0219i procesat\u0103.<\/p>\n
Acum s\u0103 analiz\u0103m dump-ul de trafic \u00een Wireshark, adic\u0103 ce a v\u0103zut \u00een acest caz DPI-ul furnizorului.<\/p>\n
\"Domain<\/p>\n
Se observ\u0103 c\u0103, mai \u00eent\u00e2i, curl a solicitat serverului DNS cheia public\u0103 eSNI pentru serverul cloudflare \u2014 o interogare TXT DNS pentru _esni.cloudflare.com (pachetul nr. 13). Apoi, folosind biblioteca openssl, curl a trimis o interogare TLS 1.3 c\u0103tre serverul cloudflare \u00een care c\u00e2mpul SNI a fost criptat cu cheia public\u0103 ob\u021binut\u0103 \u00een etapa anterioar\u0103 (pachetul nr. 22). Dar, pe l\u00e2ng\u0103 c\u00e2mpul eSNI, \u00een pachetul SSL-hello a fost inclus \u0219i un c\u00e2mp cu SNI obi\u0219nuit \u2014 deschis, pe care \u00eel putem specifica \u00een orice ordine (\u00een acest caz \u2014 www.hello-rkn.ru<\/a>). <\/b><\/p>\n
Acest c\u00e2mp de SNI deschis nu a fost luat \u00een considerare \u00een procesarea serverelor cloudflare \u0219i a fost doar un camuflaj pentru DPI-ul furnizorului. Serverul cloudflare a acceptat pachetul nostru ssl-hello, a decriptat eSNI, a extras din el SNI-ul original \u0219i l-a tratat ca \u0219i cum nimic nu s-ar fi \u00eent\u00e2mplat (a f\u0103cut totul exact cum era planificat la dezvoltarea eSNI).<\/p>\n
Singurul aspect la care ne putem ag\u0103\u021ba din perspectiva DPI este solicitarea DNS ini\u021bial\u0103 pentru _esni.cloudflare.com. Dar am f\u0103cut interogarea DNS deschis\u0103 doar pentru a ar\u0103ta cum func\u021bioneaz\u0103 acest mecanism din interior.<\/p>\n
Pentru a elimina \u00een totalitate baza de sub DPI, folosim deja men\u021bionatul mecanism DNS-over-HTTPS. O mic\u0103 explica\u021bie \u2013 DOH \u2013 este un protocol care permite protec\u021bia \u00eempotriva atacului \u00abomul din mijloc\u00bb prin trimiterea interog\u0103rii DNS prin protocolul HTTPS.<\/p>\n
Vom efectua din nou interogarea, dar de data aceasta vom ob\u021bine cheile publice eSNI prin protocolul https, nu DNS:<\/p>\n
ESNI_COVER=\"www.hello-rkn.ru\" DOH_URL=https:\/\/mozilla.cloudflare-dns.com\/dns-query .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
Dump-ul traficului solicit\u0103rii este prezentat \u00een captura de ecran de mai jos:<\/p>\n
\"Domain<\/p>\n
Se observ\u0103 c\u0103, mai \u00eent\u00e2i, curl se adreseaz\u0103 serverului mozilla.cloudflare-dns.com prin protocolul DoH (conexiune https c\u0103tre serverul 104.16.249.249), pentru a ob\u021bine valorile cheilor publice pentru criptarea SNI, iar apoi se \u00eendreapt\u0103 spre serverul de destina\u021bie, ascunz\u00e2ndu-se \u00een spatele domeniului www.hello-rkn.ru<\/a>.<\/p>\n
Pe l\u00e2ng\u0103 resolverul DoH men\u021bionat anterior mozilla.cloudflare-dns.com, putem utiliza \u0219i alte servicii populare DoH, de exemplu, cele de la celebra corpora\u021bie a r\u0103ului.
\nS\u0103 execut\u0103m o astfel de solicitare:<\/p>\n
ESNI_COVER=\"www.kremlin.ru\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
\u0218i vom primi r\u0103spunsul:<\/p>\n
< HTTP\/1.1 301 Moved Permanently\n< Date: Sun, 03 Nov 2019 14:10:22 GMT\n< Content-Type: text\/html\n< Transfer-Encoding: chunked\n< Connection: keep-alive\n< Set-Cookie: __cfduid=da0144d982437e77b0b37af7d00438b1a1572790222; expires=Mon, 02-Nov-20 14:10:22 GMT; path=\/; domain=.rutracker.nl; HttpOnly; Secure\n< Location: https:\/\/rutracker.nl\/forum\/index.php\n< CF-Cache-Status: DYNAMIC\n< Expect-CT: max-age=604800, report-uri="https:\/\/report-uri.cloudflare.com\/cdn-cgi\/beacon\/expect-ct"\n< Server: cloudflare\n< CF-RAY: 52feee696f42d891-CPH\n<\/code><\/pre>\n
\"Domain<\/p>\n
\u00cen acest caz, am contactat serverul blocat rutracker.nl, folosind un rezolvator DoH dns.google (nu este o gre\u0219eal\u0103, acum compania renumit\u0103 are un domeniu de prim nivel) \u0219i ne-am ascuns sub un alt domeniu, blocarea c\u0103ruia este strict interzis\u0103 tuturor DPI-urilor sub pedeapsa capital\u0103. Din r\u0103spunsul primit, putem \u00een\u021belege c\u0103 solicitarea noastr\u0103 a fost procesat\u0103 cu succes.<\/p>\n
Ca verificare suplimentar\u0103 a faptului c\u0103 DPI-ul providerului reac\u021bioneaz\u0103 la SNI-ul deschis, pe care \u00eel trimitem ca acoperire \u2014 putem face o solicitare c\u0103tre rutracker.nl ascunz\u00e2ndu-ne sub un alt resurs interzis, cum ar fi un alt tracker de torente \u201ebun\u201d:<\/p>\n
$ ESNI_COVER=\"rutor.info\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
Nu vom primi un r\u0103spuns de la server, deoarece solicitarea noastr\u0103 va fi blocat\u0103 de sistemul DPI.<\/p>\n
O mic\u0103 concluzie pentru prima parte<\/h3>\n
A\u0219adar, am reu\u0219it s\u0103 demonstr\u0103m func\u021bionalitatea eSNI folosind openssl \u0219i curl \u0219i s\u0103 verific\u0103m func\u021bionarea domain-fronting-ului bazat pe eSNI. \u00cen acela\u0219i mod, putem adapta instrumentele noastre preferate care folosesc biblioteca openssl pentru a func\u021biona \u201esub acoperirea\u201d altor domenii. Mai multe detalii despre acest lucru \u2014 \u00een articolele noastre urm\u0103toare.<\/p>\n
Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0442 \u0442\u0430\u043a\u0438\u0445 \u0438\u043c\u0435\u043d\u0438\u0442\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043a\u0430\u043a Cisco, BlueCoat, FireEye \u0438\u043c\u0435\u044e\u0442 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043c\u043e\u0449\u043d\u044b\u043c\u0438 \u0438\u0445 \u0441\u043e\u0431\u0440\u0430\u0442\u044c\u044f\u043c\u0438 \u2014 DPI \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0438\u043b\u0435\u043d\u043d\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435. \u0421\u0443\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0442\u0435\u0445 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0434\u043e\u0441\u043c\u043e\u0442\u0440 \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u043d\u044b\u0445\/\u0431\u0435\u043b\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432, \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52639","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Domain-fronting pe baza TLS 1.3 | ProHoster","description":"Introducere Sistemele de filtrare corporative moderne.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3 | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2026-05-20T17:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52639","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:27","updated":"2026-01-24 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=52639"}],"version-history":[{"count":3,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52639\/revisions"}],"predecessor-version":[{"id":173323,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/52639\/revisions\/173323"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=52639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=52639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=52639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}