TSG's automated QA suite (dongxiaoyan/tsg_autotest) includes an end-to-end test matrix for live HTTP/SSL content manipulation (Allow/Deny/Hijack/Insert/Replace/Redirect actions, both UI-driven and via curl scripts) and SSL interception, using a self-signed "mesalab-ca"/"tango-ca" root and intermediate CA chain with forged leaf certificates for real domains www.amazon.cn and www.bing.com, plus localized block/404 response-injection pages in Chinese, English, and Russian.
File tree: 05-Other/keyrings/end-entity/tang-ca-v3-www.amazon.cn-cer.pem, 05-Other/keyrings/end-entity/tang-ca-v3-www.bing.com-cer.pem, 05-Other/keyrings/root/mesalab-ca-cert.pem, 05-Other/keyrings/root/tango-ca-root-01-cer.pem, 05-Other/response_pages_files/404china.html, 05-Other/response_pages_files/404english.html, 05-Other/response_pages_files/404russian.html, 01-TestCase/tsg_adc/api_proxy/HijackSSLTests.robot, 01-TestCase/tsg_adc/api_proxy/InsertSSLTest.robot, 02-Keyword/tsg_ui/SecurityPolicy/InterceptSSLModule.robot
Defense implications
- The QA suite's full Allow/Deny/Hijack/Insert/Replace/Redirect test matrix for both HTTP and SSL, run against real forged certs for major domains, confirms live response rewriting and script/file injection are core, continuously-regression-tested product features, not experimental add-ons — any MITM'd TLS session at a TSG site should be treated as a live content-injection risk, not just passive logging.
- Localized 404/block pages exist for Chinese, English, and Russian, implying the response-injection product is designed for multiple deployment languages/regions beyond China, consistent with the export-customer footprint (K18, M22, E21, WMS-UTR).
Related findings
certstore's own commit history documents its transparent-TLS-MITM mechanics directly: it writes the client's observed SNI into the SAN field of the leaf certificate it mints on the fly, supports ECC issuance (secp192r1/secp256r1) for those forged certs, and reads its Trusted/Untrusted decryption-keyring configuration from MAAT's DECRYPTION_KEYRING table -- confirming the interception pipeline end-to-end: client SNI in, matching forged certificate out, gated by MAAT-synced keyring policy.
TSG's official automated regression-test suite (dongxiaoyan/autotest_tsg, Robot Framework) includes a dedicated case named AllFlowHTTPSIntercept-001.robot under tsg_adc, alongside tsg-bifang API/policy-object test keywords -- confirming HTTPS/TLS interception is a first-class, explicitly QA'd feature path in TSG rather than an incidental byproduct.
TSG has a configurable, policy-driven TLS interception (MITM) engine (service: certstore) with per-connection 'Trusted'/'Untrusted' certificate profiles, a certificate-pinning-detection classification ('Pinning' vs 'Not Pinning'), and a Dynamic Bypass toggle, tested against *.badssl.com as of TSG 22.11/22.12.
tsg-ui/demo is a TSG v3.0 "Security Policy" UI prototype (logo file literally named "TIANGOU logo", confirming TSG's Tiangou naming origin) whose page inventory enumerates the product's full policy-object model: certificate management (keyrings, SSL-decryption exclusion, trusted CA authorities), policy objects including keyword (kw) and subscriber-ID (sid) categories and a "proxy manipulation policy" object, and per-profile "Hijack Files", "Insert Scripts", "Response Pages", and "Traffic Mirror Profiles / decrypted-traffic-forwarding" configuration screens.
An internal MESA Lab report (2021-06-25) documents a live test in which a second sapp instance ('sapp B') receives fully decrypted plaintext HTTP traffic via a Unix domain socket from a third-party TLS decryption platform, while sapp A separately captures raw ciphertext via the mrzcpd driver. 24 hours of the decrypted logs (319,569 HTTP records) show the top intercepted destinations are Facebook, Twitter, Google/YouTube and Instagram, with client IPs traced to residential China Telecom/Unicom/Mobile subscribers in Guangdong, Zhejiang and other provinces.
The same 224-column TSG per-session log schema carries a full TLS- interception field set — proxy_pinning_status, proxy_intercept_status, proxy_passthrough_reason, proxy_cert_verify, proxy_intercept_error, sc_rsp_raw and sc_rsp_decrypted (raw vs. decrypted server response content) — plus ssl_esni_flag and ssl_ech_flag (explicit ECH/ESNI-usage flags), ssl_ja3_hash/ssl_ja3s_hash, and ssh_hassh (SSH client fingerprinting), confirming certstore-style MITM interception, ECH/ESNI detection, and TLS/SSH fingerprinting are all first-class fields logged on every session, not experimental add-ons.