{"id":52639,"date":"2019-11-13T00:00:00","date_gmt":"2019-11-12T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/domen-fronting-na-baze-tls-1-3"},"modified":"2026-05-20T19:54:20","modified_gmt":"2026-05-20T17:54:20","slug":"domen-fronting-na-baze-tls-1-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","title":{"rendered":"Dom\u00e9nov\u00fd fronting na z\u00e1klade TLS 1.3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00davod<\/h3>\n

\"Dom\u00e9nov\u00fd
\nS\u00fa\u010dasn\u00e9 podnikov\u00e9 syst\u00e9my na filtrovanie obsahu, od renomovan\u00fdch v\u00fdrobcov ako Cisco, BlueCoat, FireEye, maj\u00fa dos\u0165 spolo\u010dn\u00e9 s ich mocnej\u0161\u00edmi n\u00e1protivkami - syst\u00e9mami DPI, ktor\u00e9 s\u00fa intenz\u00edvne implementovan\u00e9 na n\u00e1rodnej \u00farovni. Podstata fungovania oboch typov spo\u010d\u00edva v kontrole prich\u00e1dzaj\u00faceho a odch\u00e1dzaj\u00faceho internetov\u00e9ho prenosu a na z\u00e1klade \u010diernych\/bielych zoznamov prij\u00edmaj\u00fa rozhodnutia o z\u00e1kaze internetov\u00e9ho pripojenia. A ke\u010f\u017ee obidva typy sa vo svojich z\u00e1kladoch spoliehaj\u00fa na podobn\u00e9 princ\u00edpy, aj met\u00f3dy ich obch\u00e1dzania bud\u00fa ma\u0165 ve\u013ea spolo\u010dn\u00e9ho.<\/p>\n

Jednou z technol\u00f3gi\u00ed, ktor\u00e1 umo\u017e\u0148uje pomerne efekt\u00edvne obch\u00e1dza\u0165 ako DPI, tak aj podnikov\u00e9 syst\u00e9my, je technol\u00f3gia dom\u00e9nov\u00e9ho frontingu. Jej podstata spo\u010d\u00edva v tom, \u017ee sa sna\u017e\u00edme pristupova\u0165 na zablokovan\u00fd zdroj, skryt\u00ed za inou, verejnou dom\u00e9nou, s dobrou reput\u00e1ciou, ktor\u00e1 zaru\u010dene nebude zablokovan\u00e1 \u017eiadnym syst\u00e9mom, ako napr\u00edklad google.com.<\/p>\n

O tejto technol\u00f3gii u\u017e bolo nap\u00edsan\u00fdch mno\u017estvo \u010dl\u00e1nkov a uveden\u00fdch mno\u017estvo pr\u00edkladov. Av\u0161ak popul\u00e1rne a v poslednej dobe diskutovan\u00e9 technol\u00f3gie DNS-over-HTTPS a encrypted-SNI, ako aj nov\u00e1 verzia protokolu TLS 1.3, poskytuj\u00fa mo\u017enos\u0165 presk\u00fama\u0165 \u010fal\u0161iu variantu dom\u00e9nov\u00e9ho frontingu.
\n<\/a><\/p>\n

Rozoberieme technol\u00f3giu<\/h3>\n

Najprv si objasn\u00edme z\u00e1kladn\u00e9 pojmy, aby v\u0161etci mali preh\u013ead o tom, kto je kto a na \u010do je to v\u0161etko potrebn\u00e9. Spomenuli sme mechanizmus eSNI, ktor\u00e9ho fungovanie bude \u010falej presk\u00faman\u00e9. Mechanizmus eSNI (encrypted Server Name Indication) je zabezpe\u010den\u00e1 verzia SNI, dostupn\u00e1 len pre protokol TLS 1.3. Hlavn\u00e1 podstata spo\u010d\u00edva v \u0161ifrovan\u00ed vr\u00e1tane inform\u00e1ci\u00ed o tom, na ak\u00fa dom\u00e9nu je poslan\u00e1 po\u017eiadavka.<\/p>\n

A teraz sa pozrime na fungovanie mechanizmu eSNI v praxi.<\/p>\n

Predpokladajme, \u017ee m\u00e1me internetov\u00fd zdroj, ktor\u00fd je blokovan\u00fd modern\u00fdm DPI rie\u0161en\u00edm (vezmime si napr\u00edklad zn\u00e1my torrent tracker - rutracker.nl). Pri pokuse o vstup na str\u00e1nku torrent trackeru vid\u00edme \u0161tandardn\u00fa informa\u010dn\u00fa hl\u00e1\u0161ku poskytovate\u013ea o tom, \u017ee zdroj je blokovan\u00fd:<\/p>\n

\"Dom\u00e9nov\u00fd<\/p>\n

Na str\u00e1nke RKN tento dom\u00e9nov\u00fd n\u00e1zov skuto\u010dne figuruje v \u010diernych zoznamoch:<\/p>\n

\"Dom\u00e9nov\u00fd<\/p>\n

Pri dopyte whois je vidno, \u017ee samotn\u00fd dom\u00e9nov\u00fd n\u00e1zov je 'skryt\u00fd' za cloudov\u00fdm poskytovate\u013eom Cloudflare.<\/p>\n

\"Dom\u00e9nov\u00fd<\/p>\n

Na rozdiel od \"\u0161pecialistov\" z RKN, technicky zdatnej\u0161\u00ed zamestnanci z beeline (alebo pou\u010den\u00ed zl\u00fdmi sk\u00fasenos\u0165ami n\u00e1\u0161ho zn\u00e1meho regul\u00e1tora) sa nerozhodli jednostranne zablokova\u0165 str\u00e1nku pod\u013ea IP adresy, ale zaradili do stop-listu presne dom\u00e9nov\u00e9 meno<\/a>. Je to \u013eahko overite\u013en\u00e9, ak sa pozriete, ak\u00e9 \u010fal\u0161ie dom\u00e9ny s\u00fa skryt\u00e9 za t\u00fdmto IP adresou<\/a>, nav\u0161t\u00edvte jednu z nich a uvid\u00edte, \u017ee pr\u00edstup nie je zablokovan\u00fd:<\/p>\n

\"Dom\u00e9nov\u00fd<\/p>\n

Ako to teda funguje? Ak\u00fdm sp\u00f4sobom poskytovate\u013esk\u00fd DPI zist\u00ed, na ktor\u00fa z dom\u00e9n sa m\u00f4j prehliada\u010d smeruje, ke\u010f\u017ee v\u0161etky komunik\u00e1cie prebiehaj\u00fa cez protokol https, a zatia\u013e sme si nepozorovali \u017eiadne podvody so https certifik\u00e1tmi od beeline? Je to ve\u0161tec alebo ma niekto sleduje?<\/p>\n

Sk\u00fasme odpoveda\u0165 na t\u00fato ot\u00e1zku, poh\u013eadom na prenos cez wireshark<\/p>\n

\"Dom\u00e9nov\u00fd<\/p>\n

Na sn\u00edmke obrazovky je vidie\u0165, \u017ee najprv prehliada\u010d dostane IP adresu servera cez DNS, potom prebieha \u0161tandardn\u00e9 TCP handshake so cie\u013eov\u00fdm serverom, a potom sa prehliada\u010d sna\u017e\u00ed nadviaza\u0165 ssl pripojenie so serverom. Za t\u00fdmto \u00fa\u010delom posiela paket SSL<\/a> Client Hello, v ktorom je pr\u00edtomn\u00e9 meno zdrojovej dom\u00e9ny v otvorenej podobe. Toto pole je potrebn\u00e9 frontend serveru cloudflare pre spr\u00e1vne smerovanie pripojenia. A pr\u00e1ve tu n\u00e1s zachyt\u00ed poskytovate\u013esk\u00fd DPI, preru\u0161en\u00edm n\u00e1\u0161ho pripojenia. Pri tom nedost\u00e1vame od poskytovate\u013ea \u017eiadnu blok\u00e1ciu, a vid\u00edme \u0161tandardn\u00fa chybu prehliada\u010da, akoby str\u00e1nka bola odpojen\u00e1 alebo jednoducho nefungovala:<\/p>\n

\"Dom\u00e9nov\u00fd<\/p>\n

Teraz aktivujme mechanizmus eSNI v prehliada\u010di, ako je to uveden\u00e9 v pokynoch pre Firefox <\/a>:
\nZa t\u00fdmto \u00fa\u010delom otvor\u00edme str\u00e1nku konfigur\u00e1cie Firefox about:config<\/b> a aktivujeme nasleduj\u00face nastavenia:<\/p>\n

network.trr.mode = 2;\nnetwork.trr.uri = https:\/\/mozilla.cloudflare-dns.com\/dns-query\nnetwork.security.esni.enabled = true\n<\/code><\/pre>\n
Potom skontrolujeme, \u010di nastavenia spr\u00e1vne funguj\u00fa na str\u00e1nke cloudflare pod\u013ea odkaze<\/a> a sk\u00fasime trik s na\u0161\u00edm torrent track\u0435\u0440\u043e\u043c e\u0161te raz.<\/p>\n
\"Dom\u00e9nov\u00fd<\/p>\n
Voil\u00e0. N\u00e1\u0161 ob\u013e\u00faben\u00fd tracker sa otvoril, bez ak\u00fdchko\u013evek VPN a proxy serverov. Po\u010fme sa teraz pozrie\u0165 na dump prenosu v wireshark, \u010do sa vlastne stalo.<\/p>\n
\"Dom\u00e9nov\u00fd<\/p>\n
Tentokr\u00e1t paket ssl client hello neobsahuje v otvorenej forme dom\u00e9nu ur\u010denia, miesto toho sa v r\u00e1mci paketu objavuje nov\u00e9 pole \u2014 encrypted_server_name \u2014 pr\u00e1ve tam je ulo\u017een\u00e1 hodnota rutracker.nl, a toto pole m\u00f4\u017ee de\u0161ifrova\u0165 len frontend server cloudflare. A ke\u010f\u017ee je to tak, poskytovate\u013esk\u00e9mu DPI nezost\u00e1va ni\u010d in\u00e9, ako si umy\u0165 ruky a povoli\u0165 tak\u00fdto prenos. A in\u00e9 varianty \u0161ifrovania ani nie s\u00fa.<\/p>\n
Tak\u017ee, ako funguje technol\u00f3gia v prehliada\u010di \u2014 to sme si u\u017e pozreli. Teraz sa pok\u00fasme pou\u017ei\u0165 ju na \u0161pecifickej\u0161ie a zauj\u00edmavej\u0161ie veci. A na za\u010diatok sa nau\u010d\u00edme, ako pou\u017e\u00edva\u0165 curl s eSNI na pr\u00e1cu s TLS 1.3 a z\u00e1rove\u0148 sa pozrieme na to, ako funguje dom\u00e9nov\u00fd fronting na z\u00e1klade eSNI.<\/p>\n
Dom\u00e9nov\u00fd fronting s eSNI<\/h3>\n
Ke\u010f\u017ee curl pre pripojenie cez https protokol vyu\u017e\u00edva \u0161tandardn\u00fa kni\u017enicu openssl, predov\u0161etk\u00fdm mus\u00edme zabezpe\u010di\u0165 podporu eSNI pr\u00e1ve tam. V master vetv\u00e1ch openssl zatia\u013e podpora eSNI neexistuje, preto si mus\u00edme stiahnu\u0165 \u0161peci\u00e1lnu vetvu openssl, skompilova\u0165 a nain\u0161talova\u0165 ju.<\/p>\n
Kl\u00f3niujeme repozit\u00e1r z GitHubu a kompilujeme ako obvykle:<\/p>\n
$ git clone https:\/\/github.com\/sftcd\/openssl\n$ cd openssl\n$ .\/config\n\n$ make\n$ cd esnistuff\n$ make\n<\/code><\/pre>\n
\u010ealej \u2014 klonujeme repozit\u00e1r s curl a konfigurovame jeho kompil\u00e1ciu s pou\u017eit\u00edm na\u0161ej zostavenej kni\u017enice openssl:<\/p>\n
$ cd $HOME\/code\n$ git clone https:\/\/github.com\/niallor\/curl.git curl-esni\n$ cd curl-esni\n\n$ export LD_LIBRARY_PATH=\/opt\/openssl\n$ .\/buildconf\n$ LDFLAGS=\"-L\/opt\/openssl\" .\/configure --with-ssl=\/opt\/openssl --enable-esni --enable-debug\n<\/code><\/pre>\n
Je d\u00f4le\u017eit\u00e9 spr\u00e1vne uvies\u0165 v\u0161etky adres\u00e1re, kde sa nach\u00e1dza openssl (v na\u0161om pr\u00edpade \u2014 je to \/opt\/openssl\/) a dba\u0165 na to, aby proces konfigur\u00e1cie prebehol bez ch\u00fdb.<\/p>\n
V pr\u00edpade \u00faspe\u0161nej konfigur\u00e1cie \u2014 uvid\u00edme riadok:<\/p>\n
WARNING: esni ESNI enabled but marked EXPERIMENTAL. Use with caution!<\/b><\/p>\n
$ make<\/code><\/pre>\n
Po \u00faspe\u0161nej zostave bal\u00edka vyu\u017eijeme \u0161peci\u00e1lny bash s\u00fabor z openssl na konfigur\u00e1ciu a spustenie curl. Skop\u00edrujeme ho do adres\u00e1ra s curl pre pohodlie:<\/p>\n
cp \/opt\/openssl\/esnistuff\/curl-esni <\/code><\/pre>\n
a vykon\u00e1me testovac\u00ed https-dopyt na server cloudflare, pri\u010dom z\u00e1rove\u0148 zaznamen\u00e1me DNS a TLS pakety vo Wiresharku.<\/p>\n
$ ESNI_COVER=\"www.hello-rkn.ru\" .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
V odpovedi servera, okrem mno\u017estva ladenia inform\u00e1ci\u00ed od openssl a curl, dostaneme HTTP odpove\u010f s k\u00f3dom 301 od cloudflare.<\/p>\n
HTTP\/1.1 301 Moved Permanently\n< Date: Sun, 03 Nov 2019 13:12:55 GMT\n< Transfer-Encoding: chunked\n< Connection: keep-alive\n< Cache-Control: max-age=3600\n< Expires: Sun, 03 Nov 2019 14:12:55 GMT\n< Location: https:\/\/www.cloudflare.com\/\n<\/code><\/pre>\n
\u010do sved\u010d\u00ed o tom, \u017ee n\u00e1\u0161 dopyt bol \u00faspe\u0161ne doru\u010den\u00fd na cie\u013eov\u00fd server, zachyten\u00fd a spracovan\u00fd.<\/p>\n
Teraz sa pozrime na dump trafficu vo Wiresharku, t.j. \u010do videl v tomto pr\u00edpade poskytovate\u013esk\u00fd DPI.<\/p>\n
\"Dom\u00e9nov\u00fd<\/p>\n
Je evidentn\u00e9, \u017ee na za\u010diatku sa curl obr\u00e1til na DNS server za verejn\u00fdm eSNI k\u013e\u00fa\u010dom pre server Cloudflare \u2013 TXT DNS dopyt na _esni.cloudflare.com (paket \u010d. 13). Potom, pomocou kni\u017enice OpenSSL, curl odoslal TLS 1.3 dopyt na server Cloudflare, v ktorom bolo pole SNI za\u0161ifrovan\u00e9 verejn\u00fdm k\u013e\u00fa\u010dom z\u00edskan\u00fdm v predch\u00e1dzaj\u00facom kroku (paket \u010d. 22). No, okrem po\u013ea eSNI, bol v r\u00e1mci SSL-hello paketu vlo\u017een\u00fd aj obvykl\u00fd \u2013 otvoren\u00fd SNI, ktor\u00fd m\u00f4\u017eeme zada\u0165 v \u013eubovo\u013enom porad\u00ed (v tomto pr\u00edpade \u2013 www.hello-rkn.ru<\/a>). <\/b><\/p>\n
Toto pole otvoren\u00e9ho SNI nebolo nijako zoh\u013eadnen\u00e9 pri spracovan\u00ed servermi Cloudflare a iba sl\u00fa\u017eilo ako maskovanie pre poskytovate\u013esk\u00fd DPI. Server Cloudflare prijal n\u00e1\u0161 ssl-hello paket, de\u0161ifroval eSNI, extrahoval z neho p\u00f4vodn\u00fd SNI a spracoval ho, akoby sa ni\u010d nestalo (presne tak, ako bolo napl\u00e1novan\u00e9 pri v\u00fdvoji eSNI).<\/p>\n
Jedin\u00e9, za \u010do sa v tomto pr\u00edpade d\u00e1 chyti\u0165 z poh\u013eadu DPI \u2013 prvotn\u00fd DNS dopyt na _esni.cloudflare.com. Ale my sme urobili DNS dopyt otvoren\u00fdm len preto, aby sme uk\u00e1zali, ako tento mechanizmus funguje zvn\u00fatra.<\/p>\n
Aby sme \u00faplne podkopali z\u00e1klad pod DPI, pou\u017e\u00edvame u\u017e spomenut\u00fd mechanizmus DNS-over-HTTPS. Mal\u00e9 vysvetlenie \u2013 DOH \u2013 protokol, ktor\u00fd umo\u017e\u0148uje chr\u00e1ni\u0165 sa pred \u00fatokom \u201e\u010dlovek v strede\u201c t\u00fdm, \u017ee odosiela DNS dopyt cez protokol HTTPS.<\/p>\n
Vy\u017eiadame dopyt op\u00e4\u0165, ale tentokr\u00e1t verejn\u00e9 eSNI k\u013e\u00fa\u010de z\u00edskame cez protokol https, a nie DNS:<\/p>\n
ESNI_COVER=\"www.hello-rkn.ru\" DOH_URL=https:\/\/mozilla.cloudflare-dns.com\/dns-query .\/curl-esni https:\/\/cloudflare.com\/<\/code><\/pre>\n
Dump prenosu dopytu je zobrazen\u00fd na sn\u00edmke obrazovky ni\u017e\u0161ie:<\/p>\n
\"Dom\u00e9nov\u00fd<\/p>\n
Je vidie\u0165, \u017ee najprv sa curl obracia na server mozilla.cloudflare-dns.com cez protokol DoH (https spojenie na server 104.16.249.249), aby od nich z\u00edskal hodnoty verejn\u00fdch k\u013e\u00fa\u010dov na \u0161ifrovanie SNI, a a\u017e potom na server ur\u010denia, pri\u010dom sa skr\u00fdva za dom\u00e9nou. www.hello-rkn.ru<\/a>.<\/p>\n
Okrem vy\u0161\u0161ie uveden\u00e9ho DoH resolvera mozilla.cloudflare-dns.com m\u00f4\u017eeme pou\u017ei\u0165 aj \u010fal\u0161ie popul\u00e1rne slu\u017eby DoH, napr\u00edklad od zn\u00e1mej korpor\u00e1cie zla.
\nVy\u017eiadame tak\u00fdto dopyt:<\/p>\n
ESNI_COVER=\"www.kremlin.ru\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
A dostaneme odpove\u010f:<\/p>\n
< HTTP\/1.1 301 Moved Permanently\n< Date: Sun, 03 Nov 2019 14:10:22 GMT\n< Content-Type: text\/html\n< Transfer-Encoding: chunked\n< Connection: keep-alive\n< Set-Cookie: __cfduid=da0144d982437e77b0b37af7d00438b1a1572790222; expires=Mon, 02-Nov-20 14:10:22 GMT; path=\/; domain=.rutracker.nl; HttpOnly; Secure\n< Location: https:\/\/rutracker.nl\/forum\/index.php\n< CF-Cache-Status: DYNAMIC\n< Expect-CT: max-age=604800, report-uri="https:\/\/report-uri.cloudflare.com\/cdn-cgi\/beacon\/expect-ct"\n< Server: cloudflare\n< CF-RAY: 52feee696f42d891-CPH\n<\/code><\/pre>\n
\"Dom\u00e9nov\u00fd<\/p>\n
V tomto pr\u00edpade sme sa spojili so zablokovan\u00fdm serverom rutracker.nl, pri\u010dom sme pou\u017eili DoH resolver dns.google (toto nie je preklep, teraz m\u00e1 zn\u00e1ma korpor\u00e1cia svoj vlastn\u00fd dom\u00e9nov\u00fd n\u00e1zov prvej \u00farovne) a skryli sme sa za in\u00fdm dom\u00e9nom, ktor\u00e9ho blokovanie je pr\u00edsne zak\u00e1zan\u00e9 v\u0161etk\u00fdm DPI pod hrozbou smrte\u013en\u00e9ho trestu. Z poskytnutej odpovede m\u00f4\u017eeme pochopi\u0165, \u017ee n\u00e1\u0161 dopyt bol \u00faspe\u0161ne spracovan\u00fd.<\/p>\n
Ako dodato\u010dn\u00fa kontrolu toho, \u017ee poskytovate\u013esk\u00fd DPI reaguje na otvoren\u00fd SNI, ktor\u00fd posielame ako pokrytie \u2014 m\u00f4\u017eeme vykona\u0165 dopyt na rutracker.nl zakr\u00fdvaj\u00fac sa nejak\u00fdm in\u00fdm zak\u00e1zan\u00fdm zdrojom, napr\u00edklad \u010fal\u0161\u00edm \"dobr\u00fdm\" torrentov\u00fdm trackerom:<\/p>\n
$ ESNI_COVER=\"rutor.info\" DOH_URL=https:\/\/dns.google\/dns-query .\/curl-esni https:\/\/rutracker.nl\/<\/code><\/pre>\n
Odpoveda\u0165 od servera nedostaneme, preto\u017ee n\u00e1\u0161 dopyt bude zablokovan\u00fd syst\u00e9mom DPI.<\/p>\n
Mal\u00e9 zhrnutie prvej \u010dasti<\/h3>\n
Tak\u017ee sa n\u00e1m podarilo uk\u00e1za\u0165 funk\u010dnos\u0165 eSNI pomocou openssl a curl a overi\u0165 fungovanie dom\u00e9nov\u00e9ho frontingu zalo\u017een\u00e9ho na eSNI. T\u00fdmto sp\u00f4sobom m\u00f4\u017eeme prisp\u00f4sobi\u0165 na\u0161e ob\u013e\u00faben\u00e9 n\u00e1stroje, ktor\u00e9 pou\u017e\u00edvaj\u00fa kni\u017enicu openssl, na fungovanie \"pod kryt\u00edm\" in\u00fdch dom\u00e9n. Viac o tom v na\u0161ich nasleduj\u00facich \u010dl\u00e1nkoch.<\/p>\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430, \u043e\u0442 \u0442\u0430\u043a\u0438\u0445 \u0438\u043c\u0435\u043d\u0438\u0442\u044b\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 \u043a\u0430\u043a Cisco, BlueCoat, FireEye \u0438\u043c\u0435\u044e\u0442 \u0434\u043e\u0432\u043e\u043b\u044c\u043d\u043e \u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0449\u0435\u0433\u043e \u0441 \u0431\u043e\u043b\u0435\u0435 \u043c\u043e\u0449\u043d\u044b\u043c\u0438 \u0438\u0445 \u0441\u043e\u0431\u0440\u0430\u0442\u044c\u044f\u043c\u0438 \u2014 DPI \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u0441\u0438\u043b\u0435\u043d\u043d\u043e \u0432\u043d\u0435\u0434\u0440\u044f\u044e\u0442\u0441\u044f \u043d\u0430 \u043d\u0430\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0440\u043e\u0432\u043d\u0435. \u0421\u0443\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0442\u0435\u0445 \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u044c \u0434\u043e\u0441\u043c\u043e\u0442\u0440 \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0438, \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u043d\u044b\u0445\/\u0431\u0435\u043b\u044b\u0445 \u0441\u043f\u0438\u0441\u043a\u043e\u0432, \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52639","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dom\u00e9nov\u00fd fronting na b\u00e1ze TLS 1.3 | ProHoster","description":"\u00davod Modern\u00e9 podnikov\u00e9 syst\u00e9my filtr\u00e1cie.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u043e\u043c\u0435\u043d-\u0444\u0440\u043e\u043d\u0442\u0438\u043d\u0433 \u043d\u0430 \u0431\u0430\u0437\u0435 TLS 1.3 | ProHoster","og:description":"\u0412\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0421\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/domen-fronting-na-baze-tls-1-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-12T21:00:00+00:00","article:modified_time":"2026-05-20T17:54:20+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52639","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:39:27","updated":"2026-01-24 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/52639","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=52639"}],"version-history":[{"count":3,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/52639\/revisions"}],"predecessor-version":[{"id":173323,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/52639\/revisions\/173323"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=52639"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=52639"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=52639"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}