Is this possible with SSLsplit?

Question

SSLsplit supports plain TCP, plain SSL, HTTP and HTTPS connections over both IPv4 and IPv6. For SSL and HTTPS connections, SSLsplit generates and signs forged X509v3 certificates on-the-fly, based on the original server certificate subject DN and subjectAltName extension. SSLsplit fully supports Server Name Indication (SNI) and is able to work with RSA, DSA and ECDSA keys and DHE and ECDHE cipher suites. Depending on the version of OpenSSL, SSLsplit supports SSL 3.0, TLS 1.0, TLS 1.1 and TLS 1.2, and optionally SSL 2.0 as well. SSLsplit can also use existing certificates of which the private key is available, instead of generating forged ones. SSLsplit supports NULL-prefix CN certificates and can deny OCSP requests in a generic way. For HTTP and HTTPS connections, SSLsplit removes response headers for HPKP in order to prevent public key pinning, for HSTS to allow the user to accept untrusted certificates, and Alternate Protocols to prevent switching to QUIC/SPDY. As an experimental feature, SSLsplit supports STARTTLS mechanisms in a generic manner.

Does this mean I can copy a certificate from a client(Firefox's built in store, Android's, etc.), then run SSLsplit using the copied certificate? Then I can inspect traffic from devices and programs that use custom certs and don't allow you to upload your own?

Answer 1

You question of

Does this mean I can copy a certificate from a client(Firefox's built in store, Android's, etc.)

is answered by:

SSLsplit can also use existing certificates of which the private key is available, instead of generating forged ones.

Since you don't have the private keys for the CA certificates in the built in store you cannot use these.

Answer 2

No, it does not. The bold sentence «SSLsplit can also use existing certificates of which the private key is available, instead of generating forged ones.» describes the use of server certificates which you control. If you want to intercept and log SSL/TLS to a server under your control, you have access to the server cert and key, and you can tell SSLsplit to use those directly instead of forging certificates on the fly. From the sslsplit(1) manual page:

   -t certdir
      Use  private  key,  certificate  and  certificate chain from PEM
      files in certdir  for  connections  to  hostnames  matching  the
      respective  certificates,  instead  of using certificates forged
      on-the-fly.  A single PEM file must  contain  a  single  private
      key,  a  single certificate and optionally intermediate and root
      CA certificates to use as certificate  chain.   When  using  -t,
      SSLsplit will first attempt to use a matching certificate loaded
      from certdir.  If -c and -k are also given, certificates will be
      forged on-the-fly for sites matching none of the common names in
      the certificates loaded from  certdir.   Otherwise,  connections
      matching  no  certificate  will  be  dropped, or if -P is given,
      passed through without splitting SSL/TLS.