4

I'm currently setting up a pfSense firewall in my lab. It supports SSL Inception which works pretty well for most sites.

But there are some sites which use HTTP Public Key Pinning to prevent MitM attacks and this is a real pain because the systems behind the firewall have not just been setup and have pinned public keys in some cases which then breaks SSL for those sites.

One way to get around this is disabling HPKP which is possible in firefox by setting security.cert_pinning.enforcement_level to 0 and it works well. Is there another way to get around this problem?

// The host I tried this on was a Kali machine with the Iceweasel browser.

The Error that was shown to me said the connection was droppen because of HSTS which was of cause very confusing because there were also websites that are using HSTS and the interception worked just fine. I then figured out that this seemingly has to do with HPKP and after disabling it the HSTS errors didn't show up anymore.

This seems to be a software specific issue. After @Steffen Ullrich Pointed out to me that this should not be happening I tried it with a Windows 7 Client and Chrome as a browser and it worked just fine.

Improve this question

3 Answers 3

Reset to default
6

In case of legal SSL interception the proxy CA which is used to issue the certificates for the intercepted connections gets explicitly imported into the browser/OS as trusted. In such a case browser will ignore both the builtin pinning and also the pinning done with HPKP header. This is explicitly done this way to make legal SSL interception (in firewalls, for security reasons) possible. Which means there is no need to disable public key pinning in such cases.

Improve this answer
8
  • I did import the CA Certificate in the browser. This is why it worked on the most websites in the first place but it did not work on the sites with HPKP anyway. The firewall is running on pfsense and the CA Certificate is generated by this box too and as such not signed by any trusted CA. Might this make the difference?
    – davidb
    Jul 6, 2016 at 5:45
  • @davidb: that's strange. Which browser+version/OS do you use and do you have the problem with both builtin pinning (i.e. google.com) and explicit pinning (HPKP header)? And no, these proxy CA do not need to be issued by a public CA since you trust them explicitly by importing them into the browser.
    – Steffen Ullrich
    Jul 6, 2016 at 6:03
  • I'm using Kali Linux with iceweasel as a browser. Im having a problem with explicit HPKP.
    – davidb
    Jul 6, 2016 at 8:48
  • @davidb: public CAs are not permitted to issue certificates for SSL Interception products, for good reasons.
    – Lie Ryan
    Jul 6, 2016 at 11:37
  • @davidb: what is the exact method you use to add your root certificate to the browser? It's possible the way you added the Root Certificate causes the browser to not flag the certificate as user installed.
    – Lie Ryan
    Jul 6, 2016 at 11:45
1

Is there another way to get around this problem?

Yes, you can configure your SSL interception tool to delete any HPKP headers in responses.

You'll need all users to start with a dedicated browser profile, that's only ever used under SSL interception. If the same browser profile is ever used without SSL interception, the real server may pin their Certificate again and cause issues when the user reenable SSL interception.

Improve this answer
0

As far as I understand HTTP Public Key Pinning and Certificate Pinning one of their main goals is to prevent MITM attacks.

So you would prove these technique wrong if you could break it without disabling.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .