After setting app-layer.protocols.tls.ja3-fingerprints: yes as described at https://suricata.readthedocs.io/en/suricata-4.1.0-rc1/rules/ja3-keywords.html
I still get
I didn't see anything in the port's Makefile that suggested that there was an option to enable/disable MD5 support.
The references to "md5" that I see in suricata.yaml seem only to be related to EVE output, or mail/file extraction.
What have I missed to be able to use JA3 checks?
I still get
Code:
18/7/2019 -- 09:47:25 - <Warning> -- [ERRCODE: SC_WARN_NO_JA3_SUPPORT(308)] - no MD5 calculation support built in, disabling JA3I didn't see anything in the port's Makefile that suggested that there was an option to enable/disable MD5 support.
The references to "md5" that I see in suricata.yaml seem only to be related to EVE output, or mail/file extraction.
What have I missed to be able to use JA3 checks?