###  AnalysisExpected analysis steps
1. Read scripts1. You find `http://host:port/?<regexp search query>#<URL>` shows   - element with `background-image: <URL>`   - notes only matching regexp query1. You will try to detect whether any note matches the regexp query, by controling the content located at `<URL>`.1. You notice that notes have "deletion button"   - Only when any note matches the regexp query, the image of "deletion button" is fetched.   - Hence, you'll become eager to detect whether the image of "deletion button" was fetched by the communication to `<URL>`.1. You'll find "deletion button image" has URL with `https` scheme, and its certificate was issued by *Let's Encrypt Authority X3*.   - Other HTTPS URLs (`https://cdnjs.cloudflare.com/...`, `https://cdn.jsdelivr.net/...`, `https://use.fontawesome.com/...`) use different certificates.1. The Let's Encrypt certificate is an intermediate one, which is signed by root CA *DST Root CA X3*.   - You can find the detail [here](https://letsencrypt.org/certificates/).1. What if you present a certificate signed by Let's Encrypt without the certificate for Let's Encrypt intermediate CA signed by Root CA...?   - Actually, Firefox has the cache for SSL certificates [citation needed] ! You can find it through experiments.
### Solution
1. You should prepare   - one machine with a global IP such as VPS     - If testing locally, you can use `192.168.1.100` now.   - one DNS record that points to the global IP     - There are several free Dynamic DNS services.     - If testing locally, you can use `jfwioaw.hopto.org` now.1. Get a certificate issued by *Let's Encrypt Authority X3*   - `docker run --rm -ti -v /tmp/cert/etc:/etc/letsencrypt -v /tmp/cert/var:/var/lib/letsencrypt certbot/certbot certonly --manual --preferred-challenges http --server https://acme-v02.api.letsencrypt.org/directory -d 'example.jp'`   - If testing locally, I prepared a cert for `jfwioaw.hopto.org` in this directory.1. Insert a short delay before presenting the SSL certificate   - Because you want to detect whether the certificate for "deletion image" was cached, "deletion image" fetch must precede the header image fetch.   - `socat tcp-listen:8001,bind=0.0.0.0,fork,reuseaddr system:'sleep 1; nc 127.0.0.1 5678'` (included in solver.rb)1. Terminate TLS using only the leaf certificate (i.e. use `cert.pem` without `chain.pem` and `fullchain.pem`)   - `socat openssl-listen:5678,fork,reuseaddr,certificate=cert.pem,key=privkey.pem,verify=0 system:'nc 127.0.0.1 6789'` (included in solver.rb)1. Now, you can derive the 1bit information, that is the existence of preceding "deletion image" fetch, by detecting if Firefox continues HTTP communication after SSL handshakes.