TLS Metadata without decryption

[JH8286]

Hello - can FTD/FMC running snort3 collect >TLS1.2 client hello/server cert metadata collection in connection events for example? I do not want to deploy EVE and SSL decrypt is not an option. I just want to capture server cert metadata, SNI etc. Is that possible?

[MHM Cisco World]

Tls 1.2 SNI is not encrypt you capture abd check it 

Tls 1.3 SNI is encrypt

For cert. I dont know why you want to see it ?

MHM

[JH8286]

How to capture though? Are they displayed in connection events? Server certificate should have SAN/CN/OU in clear at TLS1.2, but not sure if FTD/FMC captures this by default. It may be a snort3 thing, I only have access to snort2 sensors at the moment