HAProxy - JA3N TLS Client-Fingerprint - Lua Plugin

Intro

About JA3:

• Salesforce Repository
• HAProxy Enterprise JA3 Fingerprint
• Why JA3 broke => JA3N

NEW: JA4

About JA4:

• JA4+ Suite
• FoxIO Repository
• Cloudflare Blog
• FoxIO Blog
• FoxIO JA4 Database
• JA4 HAProxy Lua Plugin
• JA4H HAProxy Lua Plugin

---

Usage

• Add the LUA script ja3n.lua to your system

Config

• Enable SSL/TLS capture with the global setting tune.ssl.capture-buffer-size 96
• Load the LUA module by adding lua-load /etc/haproxy/lua/ja3n.lua in the global section
• Execute the LUA script on HTTP requests: http-request lua.fingerprint_ja3n
• Log the fingerprint: http-request capture var(txn.fingerprint_ja3n) len 32

---

License

This script is licensed under the MIT-license and thus is free to use.

The JA3 algorithm is licensed under the BSD 3-Clause license and also free to use - see: salesforce/ja3

---

Contribute

If you have:

• Found an issue/bug - please report it
• Have an idea on how to improve it - feel free to start a discussion
• PRs are welcome

Testing

• Run: bash test/run.sh
• Access the test website: https://localhost:6969/

Exit with CTRL+C