if you're doing this at home, the most important thing I can tell you is: If you want to do this, look at both encrypted and unencrypted streams, you CANNOT capture both on the same interface. SSLProxy changes network traffic when it decrypts it, changes sequence and ACK numbers, etc. so Suricata will get confused with it gets the encrypted stream of data, along with the unencrypted stream of data on the same interface.