💡 How Transparent MITM Interception Works

A deep dive into cella's HTTPS interception architecture: nftables, TLS MITM, CA injection, and traffic auditing.

The Problem

You want to see what HTTPS requests a container is making — but TLS encrypts everything. You can't just sniff the network. Traditional HTTP proxies require changing the application's proxy settings, which is invasive and doesn't work for all software.

cella's Approach: Transparent Proxy

cella uses nftables PREROUTING REDIRECT to invisibly intercept traffic at the kernel level. No proxy configuration needed in the container.

Step-by-step Flow

1. nftables REDIRECT: cella adds a PREROUTING rule that redirects the container's outbound port 443 traffic to cella's transparent listener on the host
2. Original destination recovery: The listener reads SO_ORIGINAL_DST from the socket to determine where the traffic was originally headed
3. TLS ClientHello inspection: cella reads the SNI (Server Name Indication) from the TLS ClientHello to identify the target domain
4. Dynamic certificate generation: cella's root CA signs a new certificate for that domain on the fly (ECDSA P-256, cached for 24 hours)
5. MITM handshake: cella completes a TLS handshake with the container using the forged cert, and opens a separate TLS connection to the real upstream server
6. Traffic relay + inspection: cella relays data between the two connections, parsing HTTP requests/responses in transit

Container ──[HTTPS]──→ nftables REDIRECT ──→ cella listener
                                                    │
                                              ┌─────┴─────┐
                                              │ TLS MITM   │
                                              │ (forged    │
                                              │  cert)     │
                                              └─────┬─────┘
                                                    │
                                              ┌─────┴─────┐
                                              │ Real TLS   │
                                              │ to upstream│
                                              └───────────┘

CA Certificate Injection

For TLS to work, the container must trust cella's root CA. cella's autosetup module handles this automatically:

• Pushes the CA cert to /usr/local/share/ca-certificates/cella-ca.crt
• Runs update-ca-certificates inside the container
• Sets NODE_EXTRA_CA_CERTS for Node.js applications

HTTP/2 Support

The MITM handler supports HTTP/2 via ALPN negotiation. When the upstream server supports h2, cella negotiates h2 on both sides of the proxy.

SSE Stream Parsing

For AI API calls that use Server-Sent Events (SSE), cella's inference stats module parses the streaming response chunks in real time to extract model names, token counts, and completion data — all without buffering the entire response.

Teardown

Pressing u in the Audit panel removes the nftables rule and the CA certificate, returning the container to its original state.