Detect HTTPS self signed certificate in (DPI) firewall

Question

TL;DR : Can a DPI firewall detect HTTPS connections that use a self-signed certificate? If so, how?

A DPI firewall that should not allow VPN connections. The firewall blocks all VPN ports by default and on port 443 it inspects the protocol to be SSL/TLS. Wrapping my VPN connection in stunnel, I can bypass this detection mechanism on port 443. Most stunnel connection use self signed certificates. Can the DPI firewall detect HTTPS connections (in this case the stunnel connection) that uses a self-signed certificate and if so, how?

Note: I want to come up with a proper solution before reporting this bug.

Thanks in advance.

Answer 1

Can a DPI firewall detect HTTPS connections that use a self-signed certificate? If so, how?

It is possible to implement such a functionality inside a DPI firewall, but that does not mean that the ability is implemented in every DPI firewall or even enabled in the specific configuration used at your side.

Usually if a DPI can do SSL interception (i.e. active man-in-the-middle of SSL/TLS connections) it will also verify the certificates. Depending on the configuration it will reject all connections which use certificates not signed by a trusted CA. But it is not known if the firewall at your site can do SSL interception at all and if it is enabled - but you could check by looking at the certificate chain. Often such DPI solutions can also be configured to accept bad certificates, although this is usually not the case by default.

It is also possible to look at the certificates of SSL/TLS connections without doing SSL interception, because the certificates are transferred in clear. But this functionality is not very common because there is not such a big use case for passive inspection of TLS traffic, that means usually inspection of the transferred data is needed which requires active SSL interception.