sslsplit.conf(5)

✨ sslsplit.conf 💖 the config file that runs the whole vibe

okay so bestie, gather round, because this is sslsplit.conf(5) — literally the manual page for sslsplit.conf, the config file that tells sslsplit(1) what to do. yes it's section 5. no we're not skipping anything. sit down, hydrate, let's go 🫶

---

🌸 NAME 🌸

sslsplit.conf — the configuration file for SSLsplit, aka sslsplit(1). it's giving "settings, but make it a text file" 💅

---

✨ DESCRIPTION ✨

so the file sslsplit.conf configures SSLsplit, which is sslsplit(1). that's it. that's the description. short queen energy 👑

---

🎀 FILE FORMAT 🎀

okay so the file is made of comments and options with arguments. the rules are genuinely so simple:

• every line that starts with a hash (#) is ignored by the parser. poof. gone. not read. that's your comment line bestie 💀
• options and arguments go like this: Option Argument. that's the whole format. it's not complicated and honestly? iconic.

and the arguments come in these two flavours:

• BOOL — a boolean value, and the valid values are yes/no. that's it, no true, no 1, don't be creative 🙈
• STRING — a string. it's a string. it strings. 🦋

---

👑 DIRECTIVES 👑

so here's the tea: when an option is not used — meaning it's hashed out with a # or it just straight up doesn't exist in the config file — sslsplit takes a default action. no drama, it just does the default thing.

and if an option doesn't have a command line equivalent? you can still override it on the command line with the -o opt=val option. slay ✨

now, the full roster. every single one. no skips. periodt 💅

• CACert STRING — use the CA cert (and key) to sign forged certs. equivalent to the -c command line option. 🔥
• CAKey STRING — use the CA key (and cert) to sign forged certs. equivalent to the -k command line option. 🔥
• ClientCert STRING — use the cert from the pemfile when the destination requests client certs. equivalent to the -a command line option.
• ClientKey STRING — use the key from the pemfile when the destination requests client certs. equivalent to the -b command line option.
• CAChain STRING — use the CA chain from the pemfile (that's intermediate and root CA certs, both). equivalent to the -C command line option. 🌈
• LeafKey STRING — use the key from the pemfile for generating leaf certs. equivalent to the -K command line option.
  • Default: generate
• LeafCRLURL STRING — use this URL as the CRL distribution point for all forged leaf certs. equivalent to the -q command line option.
• LeafCertDir STRING — use cert+chain+key PEM files from certdir to target all sites matching the common names. and for the non-matching ones? it generates if there's a CA. equivalent to the -t command line option. 🎀
• DefaultLeafCert STRING — use cert+chain+key from the PEM file for leaf certificates if there's no match in LeafCertDir. equivalent to the -A command line option.
• WriteGenCertsDir STRING — write the leaf key and only the generated certificates to gendir. equivalent to the -w command line option.
• WriteAllCertsDir STRING — write the leaf key and all the certificates to gendir. equivalent to the -W command line option.
• DenyOCSP BOOL — deny all OCSP requests on all proxyspecs. equivalent to the -O command line option.
• Passthrough BOOL — passthrough the SSL connections when they can't be split, because of client cert auth or no matching cert and no CA. equivalent to the -P command line option.
  • Default: drop
• DHGroupParams STRING — use the DH group params from the pemfile. equivalent to the -g command line option.
  • Default: keyfiles or auto
• ECDHCurve STRING — use this ECDH named curve. equivalent to the -G command line option.
  • Default: prime256v1
• SSLCompression BOOL — enable/disable SSL/TLS compression on all connections. equivalent to the -Z command line option.
• ForceSSLProto STRING — force that SSL/TLS protocol version, and only that one. equivalent to the -r command line option.
  • Default: all
• DisableSSLProto STRING — disable that SSL/TLS protocol version. equivalent to the -R command line option.
  • Default: none
• Ciphers STRING — use the given OpenSSL cipher suite spec. equivalent to the -s command line option.
  • Default: ALL:-aNULL
• OpenSSLEngine STRING — the OpenSSL engine to activate. it can be either the ID or the full path to the shared library implementing the engine. if you give it an ID, the engine needs to be known to the system-wide OpenSSL configuration. and heads up: this is only available if built against a version of OpenSSL with engine support. equivalent to the -x command line option. 🔥
• NATEngine STRING — specify the default NAT engine to use. equivalent to the -e command line option.
• User STRING — drop privileges to this user. equivalent to the -u command line option.
  • Default: nobody, if run as root
• Group STRING — drop privileges to this group. equivalent to the -m command line option.
  • Default: primary group of user
• Chroot STRING — chroot() to jaildir. heads up: this impacts sni proxyspecs, so go read sslsplit(1). equivalent to the -j command line option. 🫶
• PidFile STRING — write the pid to this file. equivalent to the -p command line option.
• ConnectLog STRING — connect log: log a one line summary per connection to logfile. equivalent to the -l command line option.
• ContentLog STRING — content log: full data to a file or a named pipe. this excludes ContentLogDir/ContentLogPathSpec. equivalent to the -L command line option.
• ContentLogDir STRING — content log: full data to separate files in dir. this excludes ContentLog/ContentLogPathSpec. equivalent to the -S command line option.
• ContentLogPathSpec STRING — content log: full data to separate files with % subst. this excludes ContentLog/ContentLogDir. equivalent to the -F command line option.
• LogProcInfo BOOL — look up the local process owning each connection, for logging. equivalent to the -i command line option. 🔍
• PcapLog STRING — pcap log: packets to pcapfile. this excludes PcapLogDir/PcapLogPathSpec. equivalent to the -X command line option.
• PcapLogDir STRING — pcap log: packets to separate files in dir. this excludes PcapLog/PcapLogPathSpec. equivalent to the -Y command line option.
• PcapLogPathSpec STRING — pcap log: packets to separate files with % subst. this excludes PcapLog/PcapLogDir. equivalent to the -y command line option.
• MirrorIf STRING — mirror packets to this interface. equivalent to the -I command line option.
• MirrorTarget STRING — mirror packets to this target address (used together with MirrorIf). equivalent to the -T command line option.
• MasterKeyLog STRING — log master keys to logfile in SSLKEYLOGFILE format. equivalent to the -M command line option. 🔑
• Daemon BOOL — daemon mode: run in the background, log error messages to syslog. equivalent to the -d command line option.
• Debug BOOL — debug mode: run in the foreground, log debug messages on stderr. equivalent to the -D command line option.
• VerifyPeer BOOL — verify the peer using default certificates.
  • Default: no
• AddSNIToCertificate BOOL — when disabled, never add the SNI to forged certificates, even if the SNI provided by the client does not match the server certificate's CN/SAN. it helps pass the wrong.host test at https://badssl.com. bestie that's a whole vibe check for your certs 🌈
  • Default: yes
• ProxySpec STRING — proxy specification: type listenaddr+port [natengine|targetaddr+port|"sni"+port]. multiple specs are allowed, one on each line. 👑

---

🦋 FILES 🦋

• /etc/sslsplit/sslsplit.conf — that's the spot, that's the home base 🏠

---

💜 AUTHOR 💜

the config file facility was added by Soner Tari <sonertari@gmail.com>. thank you king, we appreciate you 🫶

---

⭐ SEE ALSO ⭐

• sslsplit(1) — go read it, it's the main character 💅

---

and that's the whole page, no cap. every option, every default, every equivalence — all accounted for. if you skipped a line, that's on you bestie 😭

so yeah, that's sslsplit 0.5.5, dated 2024-04-01, straight out of sslsplit.conf(5) — mwah, kiss the manual, it's done ✨🎀💖