certstore

An internal MESA Lab report (2021-06-25) documents a live test in which a second sapp instance ('sapp B') receives fully decrypted plaintext HTTP traffic via a Unix domain socket from a third-party TLS decryption platform, while sapp A separately captures raw ciphertext via the mrzcpd driver. 24 hours of the decrypted logs (319,569 HTTP records) show the top intercepted destinations are Facebook, Twitter, Google/YouTube and Instagram, with client IPs traced to residential China Telecom/Unicom/Mobile subscribers in Guangdong, Zhejiang and other provinces.

The same 224-column TSG per-session log schema carries a full TLS- interception field set — proxy_pinning_status, proxy_intercept_status, proxy_passthrough_reason, proxy_cert_verify, proxy_intercept_error, sc_rsp_raw and sc_rsp_decrypted (raw vs. decrypted server response content) — plus ssl_esni_flag and ssl_ech_flag (explicit ECH/ESNI-usage flags), ssl_ja3_hash/ssl_ja3s_hash, and ssh_hassh (SSH client fingerprinting), confirming certstore-style MITM interception, ECH/ESNI detection, and TLS/SSH fingerprinting are all first-class fields logged on every session, not experimental add-ons.

An internal TSG troubleshooting runbook ("HTTPS证书替换策略无效果") documents the certstore MITM-certificate service actively serving/validating forged certificates keyed by SNI, walking an operator through checking certstore logs for specific real-world domains including Google's update service (update.googleapis.com) and Nvidia's GFE service (services.gfe.nvidia.com), and cross-checking keyring config live via maat_redis_tool.

certstore's own commit history documents its transparent-TLS-MITM mechanics directly: it writes the client's observed SNI into the SAN field of the leaf certificate it mints on the fly, supports ECC issuance (secp192r1/secp256r1) for those forged certs, and reads its Trusted/Untrusted decryption-keyring configuration from MAAT's DECRYPTION_KEYRING table -- confirming the interception pipeline end-to-end: client SNI in, matching forged certificate out, gated by MAAT-synced keyring policy.

A one-line SQL statement ("delete from pxy_exch_intermedia_cert where cert_id =219;") confirms the MITM certificate-interception service (certstore) persists its per-connection intermediate certificates in a relational database table named pxy_exch_intermedia_cert, keyed by cert_id — concrete corroboration of certstore's cert-lifecycle storage backend at the schema level.

The same ADC/TSG-OS installation guide's built-in factory acceptance test ("tsg-diagnose-oneshot") enumerates the product's certified MITM/content-manipulation actions as standard, tested features of every deployment: SSL interception with expired/self-signed/untrusted-root cert handling, and both SSL and HTTP proxy policies supporting redirect, block, replace, hijack, and insert actions, plus DNS request handling with drop and A/AAAA redirect (including TTL-range variants). This is vendor self-documentation, not inferred behavior.

Production network-topology docs for the Astana and Almaty (Kazakhstan / K18) sites show a live decrypted-traffic forwarding pipeline between an ADC front-end and an ASEM front-end over a direct fiber link, plus a distinct 'IP Spoofing' business function and dedicated static/dynamic proxy interception business lines, and a certificate-management endpoint (port 9991) — confirming operational TLS interception (MITM) infrastructure in production, not just lab capability, at both K18 sites.

The same 'tsg_galaxy_v3.session_record' schema carries explicit TLS-interception status fields per session -- proxy_pinning_status, proxy_intercept_status, proxy_passthrough_reason, proxy_cert_verify, proxy_intercept_error, proxy_client_side_version, proxy_server_side_version -- confirming that certificate-pinning detection and MITM intercept/bypass outcomes (matching the 'certstore' product's Trusted/Untrusted/Dynamic-Bypass model) are logged at per-session analytics granularity across the whole platform, not just flagged transiently at the gateway.

The TSG session_record schema in use at the Myanmar (YGN-MYTEL) deployment includes, in the same per-session record, both TLS-interception status fields (proxy_pinning_status, proxy_intercept_status, proxy_cert_verify, proxy_passthrough_reason, proxy_intercept_error) and individual-subscriber-identity fields (subscriber_id, imei, imsi, apn, phone_number) -- confirming MITM/certificate-interception capability and per-person subscriber correlation are built into the same live logging pipeline at an actual export site, not just described separately in marketing/config material.

The same Bifang deployment manual configures an 'api' service Kafka consumer on topic 'PXY-EXCH-INTERMEDIA-CERT' (consumer group 'tsg-consumer-cert') -- an explicit proxy/intermediate-certificate exchange channel, i.e. infrastructure-level evidence of how TLS-interception certificates are distributed/synced across the TSG cluster, consistent with the certstore product's described per-connection certificate-profile system.

K18_NTCS_WEB/NTC (git.mesalab.cn) is the Java/Spring web console for Kazakhstan's (K18) National Traffic Control System. Its domain model implements per-protocol keyword filtering (App/ASN/DNS/FTP/Mail/P2P/SSL keyword configs), an HTTPS proxy-MITM object (PxyObjTrustedCaCert.java), and explicit content-manipulation templates for HTTPS Redirect and Replace (complex/IP-based) plus Hijack/Insert actions, all managed through this customer-facing K18 control panel.

The K18-labeled platform's MAAT business-rule catalog includes explicit proxy content-manipulation rule types "PXY IP替换" (proxy IP replacement/substitution) and "PXY管控文件策略" (proxy file-control policy) alongside "PXY 证书管理" (proxy certificate management), giving concrete confirmation that the certificate-based MITM proxy (PXY) module supports IP-substitution and file-policy content manipulation, not merely pass/block/log actions.

The tango/kni (Kernel Network Interface) repo shows TSG's SNI/TLS-ClientHello-based interception logic (kni_entry.cpp) receiving dedicated 2024 fixes for handling TLS ClientHello fragmented across multiple packets ("ssl chello frag") and a "chello first packet hit intercept policy" bug, on top of a long-standing (2020) "dynamic bypass" feature that replaced raw-ClientHello matching with JA3 TLS fingerprints, plus counters for SSL certificate-pinning detection.

TSG's official automated regression-test suite (dongxiaoyan/autotest_tsg, Robot Framework) includes a dedicated case named AllFlowHTTPSIntercept-001.robot under tsg_adc, alongside tsg-bifang API/policy-object test keywords -- confirming HTTPS/TLS interception is a first-class, explicitly QA'd feature path in TSG rather than an incidental byproduct.

The tango/tfe ("TFE") engine ships dual root-CA trust stores (tango-ca-trust-ca.pem / tango-ca-untrust-ca.pem, mesalab-ca.pem) for TLS interception plus a JA3-fingerprint-based certificate-pinning detector with a configurable "Dynamic Bypass"; a 2021 bug ticket documents testing this against Firefox without a root cert installed visiting twitter.com, confirming live-target validation of the MITM/pinning-detection pipeline described under the certstore product.

TSG has a configurable, policy-driven TLS interception (MITM) engine (service: certstore) with per-connection 'Trusted'/'Untrusted' certificate profiles, a certificate-pinning-detection classification ('Pinning' vs 'Not Pinning'), and a Dynamic Bypass toggle, tested against *.badssl.com as of TSG 22.11/22.12.

A SQL migration renaming TSG's audit-log 'op_target_type' enum from human-readable admin-UI labels to API slugs exposes the full first-class feature list of the TSG management console, including 'Insert_Script'->insert_script and 'Hijack_File'->hijack_file (content-injection features distinct from the previously-documented cert-implant side), alongside 'Decryption_Keyrings'->ssl_keyrings, 'Trusted_Certificate_Authorities'->trusted_ca_cert, 'Response_Page'->response_page, 'Cached_Intermediate_Certificates'->exch_intermedia_cert, and 'HSM'->hsm, corroborating and extending the certstore/content-injection capability descriptions with concrete named UI object types.

The official TSG Administrator's Guide (customer-facing LaTeX source in tsg-manual/tsg-admin-guide, versioned releases through 2021) contains a dedicated 'Decryption' chapter and ships an 'AppSketch_Model' architecture diagram alongside chapters on Policies, Objects, and Monitoring -- confirming TLS interception and AppSketch-based app identification are documented, customer-configurable features of the exported TSG product rather than undisclosed internal-only capabilities.

Two independently-leaked TSG session-log CSV exports share an identical 224-field schema whose proxy_* columns (proxy_action, proxy_pinning_status, proxy_intercept_status, proxy_cert_verify, proxy_intercept_error) log the outcome of TLS interception per session, alongside ssl_ja3_hash/ssl_ja3s_hash, ssl_esni_flag, ssl_ech_flag, and quic_sni fields — confirming MITM/cert-pinning-bypass instrumentation and TLS/QUIC fingerprinting are built into TSG's standard traffic-logging pipeline, not a bolt-on feature.

tsg-ui/demo is a TSG v3.0 "Security Policy" UI prototype (logo file literally named "TIANGOU logo", confirming TSG's Tiangou naming origin) whose page inventory enumerates the product's full policy-object model: certificate management (keyrings, SSL-decryption exclusion, trusted CA authorities), policy objects including keyword (kw) and subscriber-ID (sid) categories and a "proxy manipulation policy" object, and per-profile "Hijack Files", "Insert Scripts", "Response Pages", and "Traffic Mirror Profiles / decrypted-traffic-forwarding" configuration screens.

TSG's automated QA suite (dongxiaoyan/tsg_autotest) includes an end-to-end test matrix for live HTTP/SSL content manipulation (Allow/Deny/Hijack/Insert/Replace/Redirect actions, both UI-driven and via curl scripts) and SSL interception, using a self-signed "mesalab-ca"/"tango-ca" root and intermediate CA chain with forged leaf certificates for real domains www.amazon.cn and www.bing.com, plus localized block/404 response-injection pages in Chinese, English, and Russian.

TSG's self-diagnostic suite (tsg/tsg-diagnose) imports the full badssl.com test-certificate corpus (superfish, eDellRoot, mitm-software, captive-portal, revoked, weak-key variants, etc.) to continuously validate its own TLS-interception logic in production, adds test cases for TLS ClientHello fragmentation handling by the intercept engine, and documents that firewall DENY blocking was changed from sending only a FIN to sending FIN-then-RST to close connections.

TSG's own policy API documentation (tsg/tsg-doc) defines dedicated database/API objects for live content manipulation: a content-hijack policy-file table (内容劫持策略文件) with a contentName field, and an injected-script policy-file table (注入脚本) with an insertOn (injection point) field, alongside a block-page (访问阻断页面) policy-file type — confirming content injection and block-page replacement are first-class, documented TSG policy actions.

TSG's field operations-and-maintenance toolkit (lijia/tsg_oam) runs certstore, kni, tfe, and tsgenv each as independent systemd services on TSG appliances, and includes a dedicated tsg_monit_intercept.py monitoring script alongside per-protocol monitors (tsg_monit_protocol_v3.py/v4.py) and a marsio-based traffic reader (get_traffic_by_marsio.py) -- showing the certstore/interception subsystem is treated as its own independently-monitored production service rather than an incidental sapp sub-feature.

Geedge's TSG QA automation suite (chongming/tsg_test) ships dedicated certstore test fixtures -- a full "trust" and "untrust" CA chain (tango_ca_v3_trust_ca / tango_ca_v3_untrust_ca certs and keys) plus multi-level intermediate/root test certificate chains -- used to validate TLS-interception (certstore) behavior end-to-end as part of routine regression testing.

TSG-X's NEZHA monitoring-dashboard repo (tango/tsgx_hardware) shows certstore-specific dashboard charts being added ("Add certstore charts") and, three weeks later, the dashboard-template set updated explicitly sourced from the M22 (Myanmar) deployment ("sync chart from m22"), confirming certstore (TLS-interception) has its own operational monitoring and that NEZHA dashboard templates are shared from the Myanmar site into the general TSG-X product line.

A certificate-store JSON list maps 40+ regional server hostnames of commercial VPN brands WaselPro, BVPN/BackboneVPN, iWasel, and SmokeTunnel (e.g. ca.us.waselpro.com, hk.as.bvpn.com, de.eu.smoketunnel.com) to their captured X.509 TLS certificates (base64-encoded), matching the taxonomy's certstore capability description of per-connection Trusted/Untrusted profiles and certificate-pinning-detection classification.