Destination domain extraction for secure protocols

A method for destination domain extraction for secure protocols, comprising:

• monitoring network communications between a client and a remote server using a security device;
• determining if the client sends a request to create a secure connection with the remote server, wherein the secure connection utilizes a secure protocol, the secure protocol being a secure sockets layer (SSL) protocol or transport layer security (TLS) protocol;
• and
• extracting a destination domain from the request to create the secure connection with the remote server, comprising:
• before the secure connection is created, extracting the destination domain from a server name indication (SNI) of a client hello message sent from the client to the remote server, the secure connection including an encrypted message, wherein the extracting of the destination domain from the SNI of the client hello message sent from the client to the remote server comprises:
• identifying the SNI from the client hello message during a handshaking process for setting the secure connection between the client and the remote server;
• extracting a domain identified in a public certificate sent from the remote server to the client;
• comparing the destination domain and the domain identified in the public certificate;
• and
• in the event that the destination domain matches the domain identified in the public certificate, applying a security policy based on the destination domain to filter traffic at the security device, wherein the security policy includes a whitelist/blacklist policy.

A tangible non-transitory computer readable storage medium comprising a computer program for destination domain extraction for secure protocols, the computer program comprising computer instructions for:

• monitoring network communications between a client and a remote server;
• determining if the client sends a request to create a secure connection with the remote server, wherein the secure connection utilizes a secure protocol, the secure protocol being a secure sockets layer (SSL) protocol or transport layer security (TLS) protocol;
• and
• extracting a destination domain from the request to create the secure connection with the remote server, comprising:
• before the secure connection is created, extracting the destination domain from a server name indication (SNI) of a client hello message sent from the client to the remote server, the secure connection including an encrypted message, wherein the extracting of the destination domain from the SNI of the client hello message sent from the client to the remote server comprises:
• identifying the SNI from the client hello message during a handshaking process for setting the secure connection between the client and the remote server;
• extracting a domain identified in a public certificate sent from the remote server to the client;
• comparing the destination domain and the domain identified in the public certificate;
• and
• in the event that the destination domain matches the domain identified in the public certificate, applying a security policy based on the destination domain to filter traffic at a security device, wherein the security policy includes a whitelist/blacklist policy.