I was expecting a pcap library that would try to catch server side certificates from tls handshake and block them with nflink or something, however not sure if serverhello is encrypted or not.
