zlacker

Basic filtering can be done via passively inspecting SNI headers and terminating connections to verboten hosts. However, that's not enough for some orgs, and some software works around it: https://www.bamsoftware.com/papers/fronting/

>>discre+(OP)
Even simple tls handshake filtering is broken with BlueCoat's implementation.