Add certificate hash chain pinning support to webtunnel
This merge request add certificate hash chain pinning support to webtunnel transport in lyrebird.
This adds option: cert
to bridge line.
Example bridge line(don't actually work):
Bridge webtunnel 1.2.3.4:8229 url=https://jq72vx2q-8000.eun1.devtunnels.ms/ addr=jq72vx2q-8008.eun1.devtunnels.ms:443 servername=jq72vx2q-8008.eun1.devtunnels.ms cert=tkD5HpyInq/IhfiqAj5h2Pgd93sYVEcO+1yHXYzgoJ8= utls=hellorandomizednoalpn
url
is the https websocket(wss) connection url, addr is the TCP endpoint the client will connection to, servername is the server name indication that client will send to in the TLS layer client hello, and cert
is the pinned certificate hash chain that have the same notation as pinnedPeerCertificateChainSha256
in V2Ray's TLSSetting.
To generate this cert
value:
- get the certificate chain bundle. On server, this would be the certificate file supplied to nginx or other tls server. If one does not have access to server, this info can be obtained with
openssl s_client -showcerts -servername jq72vx2q-8000.eun1.devtunnels.ms -connect jq72vx2q-8000.eun1.devtunnels.ms:443
and then manually gathering all the certificate in the supplied certificate chain. (Do not use a browser to do this, as the browser can reorder or supplement the certificate chain with its own certificate, resulting in an inconsistent certificate chain hash.) - generate the certificate chain hash with
./v2ray tls certChainHash --cert <cert.pem>