Goal
I want to get the JA3S fingerprint from openssl but it seems there is no way to retrieve the order from server hello since tls_process_server_hello() never saves the extension order.
The RAW_EXTENSION buffer are deleted in the end of tls_process_server_hello() instead of cached in SSL_CONNECTION like client hello message.
PS: If you're interested in how to get JA3 from openssl, please go to the last section. It's much easier after openssl 3.1.
What I've done
Using SSL_CTX_set_msg_callback to get the packet from server hello and parsing it seems legit, but I wonder if there is a better way.
Question
- Is there an existing api for getting the order of server extension?
- Or I missed some implicit context like "server extensions are in certain order"?
(I have seens a server hello isn't in ascending order, so I presume there is no implicit rule for it)
Just want to know if I need to submit a PR to openssl
Keywords
- openssl, server extensions, ja3 (but not much found)
Relevant post on SO
How about JA3?
If one is intereseted in JA3, a new api SSL_client_hello_get_extension_order() introduced in openssl 3.1 by this PR.
However I still parse the packet since I need JA3 without openssl in certain scenarios.