Add support for set_client_hello_callback to expose TLS ClientHello in Python to enable JA3 TLS fingerprinting

[evilaliv3]

Hello!

While working on GlobaLeaks we are evaluating performing TLS fingerprinting (e.g., JA3) during ALPN negotiation.

This is modern and common practice to being able to identify bots and ddos.

OpenSSL 1.1.1 and newer provide the SSL_CTX_set_client_hello_cb function, which allows registering a callback to receive the raw ClientHello during handshake.

Currently, PyOpenSSL does not expose this function or its related APIs, making it impossible to use this important OpenSSL feature from Python.

With this ticket i would like to propose exporting SSL_CTX_set_client_hello_cb and any related structures or functions needed to use this callback from Python, ideally via the existing SSL.Context interface.

This would allow Python projects to implement TLS ClientHello inspection cleanly and efficiently without requiring native patches or external dependencies.

Exposing this function would unlock powerful use cases such as:

• Passive TLS fingerprinting (JA3 hashing)
• Early protocol negotiation (ALPN)
• Custom TLS handshake behaviors based on ClientHello content

Thank you very much for considering this. I’m happy to assist with testing or provide examples if helpful.

[alex]

In principle this seems fine. Someone will need to figure out what the API for this will look like.

[evilaliv3]

Thank you @alex

Do you have any advice from where to start?

Does pyopenssl expor similar functions?

https://docs.openssl.org/3.3/man3/SSL_CTX_set_client_hello_cb/

[alex]

My advice would be to start with your use cases, figure out how openssl organizes the data you'd need, and design an API around it.

…

On Sun, Jul 6, 2025 at 3:07 PM Giovanni Pellerano ***@***.***> wrote: *evilaliv3* left a comment (pyca/pyopenssl#1430) <#1430 (comment)> Thank you @alex <https://github.com/alex> Do you have any advice from where to start? Does pyopenssl expor similar functions? https://docs.openssl.org/3.3/man3/SSL_CTX_set_client_hello_cb/ — Reply to this email directly, view it on GitHub <#1430 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBARIADUD4H5ZHA2NZ33HFXWXAVCNFSM6AAAAACA3BQBL6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTANBSGM2DINBQGU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- All that is necessary for evil to succeed is for good people to do nothing.