{"version":"2.1.140","anchor":"experimental-tls-termination-for-sandbox-runtime-experimenta","canonical_anchor":"experimental-tls-termination-for-sandbox-runtime-experimenta","heading":"Experimental TLS Termination for Sandbox Runtime [EXPERIMENTAL]","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.140\/e\/experimental-tls-termination-for-sandbox-runtime-experimenta","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.140","markdown":"### Experimental TLS Termination for Sandbox Runtime [EXPERIMENTAL]\n\n**What**\n\nThe sandbox runtime (SRT) can now terminate TLS in-process, making HTTPS request and response bodies visible to a per-request filter callback.\n\n**Usage**\n\n`\/\/ In a programmatic SDK \/ harness integration: { network: { tlsTerminate: { caCertPath: \"\/path\/to\/ca.crt\", \/\/ optional \u2014 omit to generate an ephemeral CA caKeyPath: \"\/path\/to\/ca.key\", }, filterRequest: (request) => { \/\/ request is a web-standard Request object if (request.url.includes(\"evil.com\")) return { action: \"deny\", reason: \"blocked domain\" }; return { action: \"allow\" }; } } }` **Details** - `network.tlsTerminate` activates in-process CONNECT interception. When a sandboxed child makes an HTTPS request, SRT intercepts the CONNECT tunnel, terminates TLS, and proxies the decrypted traffic through the existing filter pipeline. - If `caCertPath`\/`caKeyPath` are omitted, SRT generates an ephemeral RSA CA into a temp directory for the lifetime of the session and configures the sandboxed child to trust it. The ephemeral CA is cleaned up on exit. - `caCertPath` and `caKeyPath` must be provided together; providing only one throws an error. - The CA key must be RSA (non-RSA keys are rejected with `\"must be RSA\"`). - `network.tlsTerminate` and `network.mitmProxy` are mutually exclusive \u2014 enabling both throws `\"network.tlsTerminate and network.mitmProxy are mutually exclusive\"`. - `filterRequest` applies to both plain HTTP and, when `tlsTerminate` is active, to decrypted HTTPS. Denied requests receive a `403` with the reason. - Log prefixes: `[mitm-ca]` (CA lifecycle), `[mitm-leaf]` (per-host cert minting), `[tls-terminate]` (connection errors), `[request-filter]` (allow\/deny decisions). **Evidence** Full TLS intercept stack (search for `\"[mitm-ca] generated ephemeral CA at\"` or `\"tlsTerminate.caCertPath\"`)"}