Censors usually don't identify proxies by 'reading the content' — TLS already encrypts that — but by 'reading the shape': handshake traits, connection patterns, and target-domain metadata. TLS camouflage aims to make that metadata indistinguishable from normal browsing.
One thing to grasp first
Encryption ≠ invisibility. Even with content fully encrypted, the 'shape' of your traffic can still reveal you're using a proxy. Camouflage is what solves that outer-shape problem.
What DPI actually looks at
- TLS fingerprint (JA3): the cipher suites and extension order a client declares can reveal whether it's a common browser;
- SNI: the target domain carried in plaintext during the handshake — the easiest field to inspect and block;
- ALPN and certificate: the negotiated application protocol and whether the cert chain is trusted;
- Traffic timing: whether request sizes and rhythm look like a human browsing the web.
How clickone blends in
- Uses valid TLS certificates and mainstream cipher suites so the handshake fingerprint resembles an ordinary browser;
- Hides the proxy path behind a normal HTTPS site path, presenting an ordinary domain in SNI;
- Leverages XHTTP so request rhythm approximates real page visits, softening timing signatures.
No scheme is 'forever undetectable,' but looking enough like the bulk of normal traffic raises the cost of collateral damage — for the censor, blocking you may mean blocking legitimate sites too.