Skip to content

PSA Intelligence Impersonate Proxy

pypi python build tests license impersonate-proxy logo

HTTP/HTTPS proxy that impersonates browser TLS fingerprints using curl_cffi that can be effective in avoiding blocks against non-browser clients.

Attribution

This project started as a fork of hauxir/tls-impersonate-proxy and has now evolved beyond a pull request to merge. This impersonate-proxy project is maintained at psaintelligence/impersonate-proxy.

Pypi: pypi.org/project/impersonate-proxy

GHCR: github.com/psaintelligence/impersonate-proxy/pkgs/container

Quick Start (Docker)

Spin up the proxy container:

docker run --rm -p 8899:8899 \
  -v /tmp/impersonate-certs:/root/.config/impersonate-proxy \
  ghcr.io/psaintelligence/impersonate-proxy:latest

Once started, configure your client to trust the CA and use the proxy:

# Export the generated CA cert to trust the proxy
export SSL_CERT_FILE=/tmp/impersonate-certs/ca.crt

# Issue request through the proxy
curl --silent -x http://127.0.0.1:8899 https://tls.browserleaks.com/json

Quick Start (pip / uv)

Install and start the proxy locally:

# Install via pipx from pypi
pipx install impersonate-proxy

# Or install via uv from source
uv pip install git+https://github.com/psaintelligence/impersonate-proxy.git

# Start the proxy (default: 127.0.0.1:8899)
impersonate-proxy

Features

  • TLS Impersonation: Disguises client TLS fingerprints as standard browsers (Chrome or Firefox).
  • Header Adapter & Delegation: Strips conflicting non-browser client headers (e.g. User-Agent: python-httpx) so native curl-impersonate profile defaults shine through, while preserving payload and auth semantics.
  • Connection Keep-Alive & Session Pooling: Reuses TLS sessions and upstream TCP connections to optimize latency and handle high-concurrency requests.
  • Fast Dynamic Cert Generation: Dynamic certificate generation using fast Elliptic Curve (ECDSA P-256) cryptography with leaf key reuse.

Capabilities

Capability What it does Benefit
TLS Fingerprinting Matches JA3/JA4/HTTP2 fingerprints with real browsers Defeats Cloudflare, Akamai, and Imperva WAF blocks
MITM CONNECT Decryption Decrypts and re-signs HTTPS traffic using local CA Allows inspection, header filtering, and proxying of TLS streams
Header Delegation Strips non-browser headers and delegates to curl-impersonate Ensures User-Agent and TLS fingerprint profiles align natively without duplication
Session Pooling Maintains queue-based reusable curl_cffi sessions Boosts performance for concurrent request bursts to ~70+ RPS
P-256 Cryptography Reuses a static leaf private key for ECDSA cert creation Reduces leaf certificate dynamic issuance time to <1ms

Guided Tour

  • Installation Guide: System setup, CLI parameters, and Docker integrations.
  • How It Works: Deep dive into the interception pipeline, session pool, and header delegation mechanism.