Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to know if a CA Cert I installed can be used to perform DPI-SSL decryption without my knowledge. Would there be any indication? Can you look at the cert properties to determine if it can be used for this purpose?

share|improve this question

DPI-SSL works by doing a man in the middle attack: it frames the right server by dynamically generating a fake certificate for that server. This works only if the corresponding CA (the one which issues the fake certificate on-the-fly) is "trusted" by the client. By definition, this CA "looks like" any other CA It is different from the "normal" CA only in that the private key is owned by some system which does the DPI, but this is not written on the certificate itself.

What you can do is compare the certificates that your machine trusts with that from the "root CA" store of a generic desktop system; compare the "thumbprints" (these are the hash values computed over the root certificates themselves). Presumably, the default root CA are not involved in DPI; any extra certificate is then a potential suspect.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.