Soner Tari<p><strong>My FOSS SSLproxy Needs HTTP/2 Support for Next-Gen Network Security (The "Invisible Threat" is Growing)</strong></p><p>I'm the long-time maintainer of <strong>SSLproxy</strong> (and the co-maintainer of SSLsplit), a unique open-source transparent SSL/TLS proxy. Its core strength lies in its ability to decrypt and <em>divert</em> network traffic to other security tools (like E2guardian, Snort IPS, POP3 proxy, SMTP proxy, Virus and Spam scanners as in my UTMFW firewall) for <strong>deep SSL inspection</strong>. It's truly the <em>only</em> FOSS tool offering this transparent, <strong>real-time diversion capability</strong> to enable UTM services on encrypted streams. (For context: popular tools like <code>mitmproxy</code>, while powerful, expect you to write/use extensions for inspection rather than diverting traffic for existing services.)</p><p><strong>The Problem: HTTP/2 is Hiding Threats in Plain Sight</strong></p><p>In 2025, nearly a third of all websites have adopted HTTP/2. Here's the critical challenge for open-source cybersecurity: Current FOSS security tools, including SSLproxy and many downstream listening programs (like E2guardian, Squid, Snort), often <em>cannot fully understand or process</em> this HTTP/2 traffic in <em>real-time</em>. This is a significant gap, as commercial closed-source firewalls and libraries <em>do</em> offer <em>real-time</em> HTTP/2 SSL inspection capabilities. (For context: there are open/closed-source solutions for offline analysis.)</p><p>Currently, SSLproxy either prevents HTTP/2 upgrade or allows you to bypass HTTP/2 traffic using its powerful filtering features. However, neither offers the deep, <em>real-time</em> inspection needed for comprehensive security.</p><p>This creates a dangerous "translation gap" in the open-source ecosystem, where a growing portion of encrypted internet traffic is effectively invisible to <em>real-time</em> deep inspection, forcing reliance on proprietary solutions for full visibility.</p><p><strong>Why This Matters for You:</strong></p><ul><li><strong>Deep Inspection is Blind:</strong> Without <em>real-time</em> HTTP/2 support, the vast majority of modern encrypted traffic bypasses essential content filtering, intrusion detection, and virus scanning that FOSS tools could otherwise provide.</li><li><strong>Essential for UTM:</strong> Projects like my UTMFW heavily rely on SSLproxy to feed decrypted traffic into their core services. Lacking HTTP/2 support in SSLproxy (and integrated UTM services) means a critical blind spot in next-gen firewall capabilities.</li><li><strong>Security Professionals Need It:</strong> If you're a cybersecurity professional relying on FOSS tools to inspect TCP, SSL/TLS, and HTTPS traffic for analysis, this directly impacts your ability to gain full visibility into modern network communications.</li></ul><p><strong>The Solution & The Challenge Ahead:</strong></p><p>SSLproxy <em>must</em> evolve to natively speak HTTP/2 and transparently translate it back to HTTP/1 for seamless integration with existing downstream security tools. This is a substantial engineering effort, requiring the integration of complex libraries like <a href="https://nghttp2.org" rel="nofollow noopener" target="_blank">nghttp2</a> and <a href="https://nghttp2.org/documentation/nghttpx-howto.html" rel="nofollow noopener" target="_blank">nghttpx</a>, and a dedicated focus.</p><p><strong>How You Can Help Fuel This Critical Work:</strong></p><p>My FOSS projects are fueled by a deep commitment to open-source security, but developing and maintaining these complex, vital features demands significant time and resources. If you or your organization benefit from open-source network security tools like SSLproxy, your support is invaluable.</p><p>Sponsorship enables me to dedicate full-time effort to delivering crucial advancements like comprehensive HTTP/2 support, improved TLS compatibility, Windows support, and much more.</p><p>You can learn more about SSLproxy, UTMFW, and my other projects, including the full roadmap, here:</p><p>➡️ <strong>My New Website: <a href="https://sonertari.github.io" rel="nofollow noopener" target="_blank">https://sonertari.github.io</a></strong></p><p>➡️ <strong>GitHub Project Boards (Full Roadmap): <a href="https://github.com/sonertari?tab=projects" rel="nofollow noopener" target="_blank">https://github.com/sonertari?tab=projects</a></strong></p><p><a href="https://infosec.exchange/tags/FOSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>FOSS</span></a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Cybersecurity</span></a> <a href="https://infosec.exchange/tags/NetworkSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NetworkSecurity</span></a> <a href="https://infosec.exchange/tags/OpenSource" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OpenSource</span></a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>InfoSec</span></a> <a href="https://infosec.exchange/tags/SSLproxy" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SSLproxy</span></a> <a href="https://infosec.exchange/tags/UTMFW" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>UTMFW</span></a> <a href="https://infosec.exchange/tags/HTTP2" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>HTTP2</span></a> <a href="https://infosec.exchange/tags/Firewall" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Firewall</span></a> <a href="https://infosec.exchange/tags/IPS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>IPS</span></a> <a href="https://infosec.exchange/tags/Sponsorship" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Sponsorship</span></a> <a href="https://infosec.exchange/tags/ComixWall" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ComixWall</span></a></p>