Internal design docs for a "特定网站开放通道试点方案" (pilot program for an open channel to specific websites) show the MESA Lab's parent CAS institute built its own transparent/forward-proxy circumvention system to give ~3,000 staff SNI/DNS- routed access to Google and other blocked sites over a leased VPN line, requiring staff to install a MITM root certificate for HTTPS decryption and mirroring all such traffic for analysis; a higher-bandwidth "两可通道" upgrade is noted as requiring approval from China's Cyberspace Administration (网信办) because the institute "bears risk responsibility" for it.
两可通道具备带宽大、连接稳定的优势，但需向网信办报备审批，且研究所需要承担风险责任，需所领导批示。
capabilitymitm-cert-implant