<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting TLS Interception

## JA3 Fingerprinting via tshark

### Synopsis

```bash
tshark -i <iface> -Y 'tls.handshake.type == 1' -T fields \
  -e ip.src -e tls.handshake.ja3 [-c <count>]
```

### Key Fields

| Field | Description |
|---|---|
| `tls.handshake.ja3` | MD5 of TLS Client Hello parameters |
| `tls.handshake.ja3s` | MD5 of TLS Server Hello parameters |

## crt.sh API

### Synopsis

```bash
curl -s "https://crt.sh/?q=<domain>&output=json"
```

### Response Fields

| Field | Description |
|---|---|
| `issuer_name` | Certificate issuer DN |
| `common_name` | Certificate CN |
| `not_before` / `not_after` | Validity window |

## Known TLS Proxy Signatures

| Product | Issuer Pattern |
|---|---|
| Blue Coat | `Blue Coat Public Services Intermediate CA` |
| Fortigate | `Fortinet CA` |
| Zscaler | `Zscaler Intermediate Root CA` |

## Agent Script

```bash
node agent.js check example.com
node agent.js ct-logs example.com
node agent.js ja3 -i eth0 -c 50
node agent.js audit-store
```
