Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am doing some research on man-in-the-middle focusing on SSL in particular.

I have been looking into generating a certificate on request when a client connects and requests a secured page.

Assuming that;

  • Client is connected to AP controlled by me and ignoring cert validation
  • AP is running airmon-ng and airbas-ng with DHCP.
  • OS is Debian on a Rasp Pi, that then forwards to the real WWW

Is it feasible to generate a certificate per request, and if so, are tools available for this, or would the request have to be scripted to sign a cert via OpenSSL, and logging the event.


share|improve this question

I use mitmproxy (and HoneyProxy a graphical interface to it) at work to do that. Works perfectly.

Relevant part of the documentation about SSL:

share|improve this answer

Yes, it's possible.

10 seconds of googling gives you a link to the dynamic SSl generation feature of Squid and that links to the (necessary) SSLBump feature that implements the MITM attack itself.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.