How to detect HTTPS traffic without decryption?

Rules
,
1

How can I use Suricata to detect and generate alerts for HTTPS traffic without decrypting it?

1. Do not use certificates.

2

Hi!
maybe detect size packets during session?
I think, that you can’t decrypt https without certificates to detect headers in packets

You can try use PolarProxy and suricata Sniffing Decrypted TLS Traffic with Security Onion

3

Use (supported) metadata (packet size, frequency, related domains/ips, traffic “patterns” …), think out of the box, don’t focus too much in the encrypted content.