{"action":"opened","issue":{"url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/2994","repository_url":"https://api.github.com/repos/mitmproxy/mitmproxy","labels_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/2994/labels{/name}","comments_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/2994/comments","events_url":"https://api.github.com/repos/mitmproxy/mitmproxy/issues/2994/events","html_url":"https://github.com/mitmproxy/mitmproxy/issues/2994","id":305906408,"number":2994,"title":"Limiting interception to only those domains that I have the SSL cert for in transparent mode","user":{"login":"hariszukanovic","id":1234728,"avatar_url":"https://avatars1.githubusercontent.com/u/1234728?v=4","gravatar_id":"","url":"https://api.github.com/users/hariszukanovic","html_url":"https://github.com/hariszukanovic","followers_url":"https://api.github.com/users/hariszukanovic/followers","following_url":"https://api.github.com/users/hariszukanovic/following{/other_user}","gists_url":"https://api.github.com/users/hariszukanovic/gists{/gist_id}","starred_url":"https://api.github.com/users/hariszukanovic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hariszukanovic/subscriptions","organizations_url":"https://api.github.com/users/hariszukanovic/orgs","repos_url":"https://api.github.com/users/hariszukanovic/repos","events_url":"https://api.github.com/users/hariszukanovic/events{/privacy}","received_events_url":"https://api.github.com/users/hariszukanovic/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-16T12:16:36Z","updated_at":"2018-03-16T12:16:36Z","closed_at":null,"author_association":"NONE","body":"I believe the correct way to accomplish this would be using --ignore-hosts as indicated with an example in the docs at https://mitmproxy.org/docs/latest/howto-ignoredomains/\r\nusing the concrete example\r\n# Ignore everything but example.com and mitmproxy.org:\r\n--ignore-hosts '^(?!example\\.com)(?!mitmproxy\\.org)'\r\n\r\nI am certain that there is SNI support towards those servers that I DO want to intercept (these are my servers which run under HTTPS) because I can provide to mitmproxy the certs.\r\nFor those, I provide cert using --cert example.com=/opt/certs/example.com.pem which works perfectly when it actually intercepts for those domains.\r\n\r\n##### Steps to reproduce the problem:\r\nRunning in transparent mode with --ignore-hosts using regex negative lookahead (to intercept SSL for only some hosts)\r\n\r\nFull command (please use your own domain for which you would have the cert available):\r\n/usr/bin/mitmweb --web-iface=192.168.0.252 --listen-host=192.168.0.252 --mode transparent --showhost --cert example.com=/opt/certs/example.com.pem --cert mitmproxy.org=/opt/certs/mitmproxy.org.pem --ignore-hosts '^(?!example\\.com)(?!mitmproxy\\.org)'\r\n\r\n\r\n##### Any other comments? What have you tried so far?\r\nI have tried an endless number of regex combinations without success. Even for the simplest possible case. It seems as if either all requests are ignored or all requests are intercepted.\r\n\r\n\r\n##### System information\r\n<!-- Paste the output of \"mitmproxy --version\" here. -->\r\nmitmproxy --version\r\nMitmproxy: 3.0.3 \r\nPython:    3.5.5\r\nOpenSSL:   OpenSSL 1.1.0g  2 Nov 2017\r\nPlatform:  Linux-3.10.0-693.21.1.el7.x86_64-x86_64-with-centos-7.4.1708-Core\r\n\r\n\r\n<!-- Please use the mitmproxy forums (https://discourse.mitmproxy.org/) for support/how-to questions. Thanks! :) -->\r\n"}}
{"actor":{"display_login":"hariszukanovic"}}