SSL/TLS Setup

Quick Start#

Use the included script to generate a self-signed certificate:

cd dist
bash ssl_gen.sh

This runs:

openssl req -x509 -nodes -newkey rsa:2048 \
    -keyout server.rsa.key -out server.rsa.crt -days 3650

You’ll be prompted for certificate details (country, organization, common name, etc.). For quick testing, you can press Enter to accept defaults.

Certificate Types#

RSA (Default)#

RSA 2048-bit is the default and is broadly compatible:

openssl req -x509 -nodes -newkey rsa:2048 \
    -keyout server.rsa.key -out server.rsa.crt -days 3650

For stronger security, use RSA 4096:

openssl req -x509 -nodes -newkey rsa:4096 \
    -keyout server.rsa.key -out server.rsa.crt -days 3650

ECDSA#

ECDSA provides equivalent security with smaller keys and faster handshakes:

openssl req -x509 -nodes -newkey ec:secp384r1 \
    -keyout server.ecdsa.key -out server.ecdsa.crt -days 3650

Update profile.yaml to use the ECDSA certificate:

Teamserver:
  cert: "server.ecdsa.crt"
  key: "server.ecdsa.key"

Configuration in profile.yaml#

TLS Version Control#

HttpServer:
  tls:
    min_version: "TLS1.2"
    max_version: "TLS1.3"

Available versions: TLS1.0, TLS1.1, TLS1.2, TLS1.3

Cipher Suite Selection#

Configure which cipher suites the server offers:

HttpServer:
  tls:
    cipher_suites:
      - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
      - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
      - "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
      - "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
      - "TLS_RSA_WITH_AES_128_GCM_SHA256"
      - "TLS_RSA_WITH_AES_256_GCM_SHA384"

Server Cipher Preference#

HttpServer:
  tls:
    prefer_server_cipher_suites: false

When true, the server’s cipher suite preference order takes priority over the client’s. This gives you more control over which cipher is negotiated.

OPSEC Considerations#

Certificate Fingerprinting#

Self-signed certificates have distinctive characteristics that may be fingerprinted by network monitoring tools. For operational engagements:

1. Use certificates that match your cover story — If impersonating a specific service, generate certificates with matching subject fields
2. Consider using Let’s Encrypt for real domain certificates when your infrastructure allows it
3. Match the certificate type to the impersonated server — nginx typically uses RSA, some modern services use ECDSA

Generating a Convincing Certificate#

openssl req -x509 -nodes -newkey rsa:2048 \
    -keyout server.rsa.key -out server.rsa.crt -days 365 \
    -subj "/C=US/ST=California/L=San Francisco/O=Cloudflare Inc/CN=*.example.com"

JA3/JA3S Fingerprinting#

The TLS configuration (version, cipher suites) affects the server’s JA3S fingerprint. To blend in:

• Use cipher suites common for your cover server (nginx, Apache, IIS)
• Enable TLS 1.2 and 1.3 (most modern servers support both)
• Include a reasonable set of cipher suites — too few or unusual combinations stand out