TL;DR : Can a DPI firewall detect HTTPS connections that use a self-signed certificate? If so, how?

A DPI firewall that should not allow VPN connections. The firewall blocks all VPN ports by default and on port 443 it inspects the protocol to be SSL/TLS. Wrapping my VPN connection in stunnel, I can bypass this detection mechanism on port 443. Most stunnel connection use self signed certificates. Can the DPI firewall detect HTTPS connections (in this case the stunnel connection) that uses a self-signed certificate and if so, how?

Note: I want to come up with a proper solution before reporting this bug.

Thanks in advance.

  • What vendor/model of firewall do you use? Commented Nov 13, 2015 at 17:00
  • I do not know that exactly.
    – Joseph
    Commented Nov 14, 2015 at 12:17

1 Answer 1


Can a DPI firewall detect HTTPS connections that use a self-signed certificate? If so, how?

It is possible to implement such a functionality inside a DPI firewall, but that does not mean that the ability is implemented in every DPI firewall or even enabled in the specific configuration used at your side.

Usually if a DPI can do SSL interception (i.e. active man-in-the-middle of SSL/TLS connections) it will also verify the certificates. Depending on the configuration it will reject all connections which use certificates not signed by a trusted CA. But it is not known if the firewall at your site can do SSL interception at all and if it is enabled - but you could check by looking at the certificate chain. Often such DPI solutions can also be configured to accept bad certificates, although this is usually not the case by default.

It is also possible to look at the certificates of SSL/TLS connections without doing SSL interception, because the certificates are transferred in clear. But this functionality is not very common because there is not such a big use case for passive inspection of TLS traffic, that means usually inspection of the transferred data is needed which requires active SSL interception.

  • Thank you. I'll inspect my outgoing connection first with Wireshark and Charles proxy. Any other recommendations on how to do the exact detection?
    – Joseph
    Commented Nov 13, 2015 at 16:08
  • @Joseph: for manual detection just passively sniffing with wireshark is sufficient because you can have a look at the certificates there. Automatic detection is more complex and if this is possible at all and how it can be done depends on your local DPI solution. Commented Nov 13, 2015 at 16:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .