I have a fully controlled environment (routing, DNS, CA, private keys, certificates) between two closed appliances that communicate over HTTPS. The traffic is over a mutual TLS authenticated channel, using Server Name Indication, as well as elliptic curve keys.
I need a tool (or set of tools) which can use my existing client and server private keys and certificates, as well as capable of doing SNI, to "impersonate" the server towards the client, copy/dump decrypted traffic, then relay on the traffic as if coming from the client and vice-versa.
I can't do much against the appliances themselves (such as excluding EC/DH keys, to permit simple decrypting of traffic at a later stage) but I have all the certificates and private keys and I can manually send the traffic where I want, I do not need particular proxying tricks.
I had some moderate success with openssl s_client / s_server + tee into a pipe, but this seems to break after just one connection.
Other tools I have tried either can't handle SNI, or insist on "faking" certificates, which I really do not need or want (especially if the fake certificates do not meet my/app requirements) and are usually more general purpose than my needs.
I am not looking for a commercial grade appliance or software, and I do not need the possible solution to generate certificates. I have them, as well as the private keys.
I need something that can listen on tcp/443 with the provided PK/cert/chain and establish the TLS session, store/dump the unencrypted data, then replay the content received from the client towards the server, in another TLS session using SNI and the provided client PK/cert/chain as closely matching the original as possible. It should be able to handle and relay response data as well on the same TLS session, as well as multiple (as in series, not parallel) connections. I need to capture traffic strictly between the two well known boxes.