> How long until these appliances start altering the HTTP request's User-Agent header to avoid detection (or adding logic such that the handshaking process mimi

> How long until these appliances start altering the HTTP request's User-Agent header to avoid detection (or adding logic such that the handshaking process mimics that of the browser), though? A TLS proxy that does this is meddling with the application layer and is thus broken (IMO). A TLS proxy that doesn't want to be detected shouldn't mess with the application layer. The best thing a TLS proxy can do (other than be turned off) is preserve the characteristics of the original TLS connection exactly. Indeed, Caddy's implementation is mainly for detecting TLS proxies that do a lousy job at it.