@defensivedepth could you just operate an "IR" or "forensic" TLS server instead? Presumably this is something you're doing multiple times?