3

This question already has an answer here:

My employer has deployed a fake root CA to my work laptop in order to carry out MitM style interception and inspection of HTTPS traffic.

It's straight-forward to determine whether HTTPS traffic to a particular site is being intercepted from the browser by inspecting the certificate and noting the dodgy CA, but is there any way of doing this on the server side? In other words, could I configure my web server to check whether the certificate that the browser sees is the same as the certificate provided by the web server?

marked as duplicate by Steffen Ullrich, Stephane, Steve, Serge Ballesta, Xander Nov 28 '16 at 17:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    @SteffenUllrich I think it is not a duplicate because the older question has so many restrictions on what can be done server side, that it most likely rules out the best solutions for the more common cases. – kasperd Nov 25 '16 at 7:42
4

If the server requires client certificate authentication then it will fail in case of intercepting proxy server. A tunneling proxy server will (most likely) work but it will be unable to decrypt the data.

  • I don't think that was part of the question. i.e. the OP was asking whether it would be possible for the server to detect that the client is using the right certificate for its access and not a rogue certificate. – Alexis Wilke Aug 7 '18 at 22:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.