TL;DR : Can a DPI firewall detect HTTPS connections that use a self-signed certificate? If so, how?
A DPI firewall that should not allow VPN connections. The firewall blocks all VPN ports by default and on port 443 it inspects the protocol to be SSL/TLS. Wrapping my VPN connection in stunnel, I can bypass this detection mechanism on port 443. Most stunnel connection use self signed certificates. Can the DPI firewall detect HTTPS connections (in this case the stunnel connection) that uses a self-signed certificate and if so, how?
Note: I want to come up with a proper solution before reporting this bug.
Thanks in advance.