Feature Request: Full remote certificate inspection and duplication for TLS MITM about g3

[zh-jq-b]

I'm also considering send the real server cert to cert generator and use it as a template for the generated fake cert.
One another way is to let the cert generator fetch the real server cert by itself.
And we may also need to add domain level rules in the cert generator, such like use more wildcard domain certs to allow more reuse.
It's still undecided yet.

[mspublic]

Those all sound like good options.

I like your first idea of sending the certificate to the generator the best - in some cases the cert generator may be on a machine that does not have direct internet access (potentially connected to an HSM) so having the certificate provided to it could be optimal.

One thing to also think about in long term is authentication/encryption between proxy and cert generator. Maybe wrap the connection with mtls?