Are you aware of any proxy or firewall device which will permit outbound SSL connections to hosts with approved* SSL certificates only?
Consider the following scenario.
I have a server farm which is protected from the Internet by a firewall. Let's say HTTPS is allowed in from the Internet, but that the firewall blocks outbound access from these machines to the Internet. I don't want my server admins getting bored and surfing /. from the data center, and I don't want malware or malicious actors being able to connect outbound easily in the event of a breach.
I do want to permit some outbound access, though. For example, let's say I want my Windows servers to go out to windowsupdate.microsoft.com. If I can determine the IPs used by windowsupdate, fine, I open them up specifically in the firewall, no problem.
But what if those IPs aren't known, or aren't knowable? Specifically, let's say Microsoft is using Akamai or another CDN to serve their files. The IP address that you reach out to is going to be difficult to determine ahead of time and will change regularly. I can't whitelist by IP in that case.
One elegant solution - presuming that we're reaching out to an SSL-protected service - is to whitelist based on the SSL certificate rather than the IP address. So, if the server certificate is *.windowsupdate.microsoft.com and it's signed by a valid CA, then permit the connection. If it's not *.windowsupdate.microsoft.com, or if it's signed by SnakeOil, then disallow the connection.
(Approved certificate could mean any number of flexible things. Name and trusted CA; Name and specific CA; Specific CA-signed certs; etc. etc.)
The control point must not be at the internal server - if a malicious actor gains access to it, they must not be able to disable this protection. As with IP whitelisting, it makes sense to remove the control to the perimeter as a proxy or firewall device.
That seems to me to be the right way to do it. What are my options for doing it this way? Is this a paradigm anyone has ever implemented, free or commercial? Are their other paradigms I should be aware of that can clamp down on outgoing access in a flexible but powerful way that meets modern (Akamai, AWS, Dyn-ish) dynamic services?
Any help appreciated!