Re: [Ice] TLS Candidates

[Bernard Aboba <[e-mail]>]

Roman said:


"We have encountered a few large corporate installations that only allowed
TLS connections to port 443."

[BA] We have also encountered these deployments, and initially
implemented a "fake" TLS handshake along the lines that Peter
describes. However, we found that some customers had installed deep
packet inspection boxes that could tell the difference between a
"fake" TLS handshake and a real one. So having a standardized way to
do TLS candidates would be a good idea.

On Tue, Jan 24, 2017 at 4:21 PM, Peter Thatcher <[e-mail]>
wrote:

> Our implementation of ICE has a type of candidate called "SSLTCP" which
> does a fake TLS handshake to get through firewalls that only allow TLS
> connections.  We've been using it for years.  And I'm guessing some of our
> web products would appreciate that being in other browsers as well, so we
> may be interested in seeing it as part of the standard (or a less fake
> version of it).  But I don't have any stats about how often those work but
> normal TCP candidates don't, so I can't say for sure how useful it really
> is.