3

To my knowledge my company performs SSL Interception. Still if I visit a website I host, that uses a Let´s Encrypt certificate, the browser shows me my legit Let´s Encrypt cert.

To my understanding SSL Interception works like this:

My Client <----- encrypted with self signed cert from the firewall ----> Firewall (/w SSL Interception) <----- encrypted with the legit cert of the webiste----> HTTPS Webservice

Where the CA or Certificate that is used by the Firewall to intercept SSL has to be trusted by the Client (via GPO, etc.) and the browser of the client should show the interception certificate in the URL-bar.

So, is the SSL-Interception not working (i.e. misconfigured) or is it possible to do SSL-Interception with only the legit Certificate showing (from the Clients point of view)

Improve this question
1
  • " and the browser of the client should show the interception certificate in the URL-bar" and it will also show the warning Your connection to this site is not private. The firewall operator has to install his root certificate in your browser to make his self signed TLS certificate undetectable else your browser will always detect interception.
    – defalt
    Dec 20, 2016 at 8:23

1 Answer 1

Reset to default
3

It is not possible to do SSL interception with current TLS protocols without terminating the SSL connection at the interceptor and creating a new one. Since the interceptor does not have the private key of the original certificate a new certificate has to be used which is visible by the client.

In other words: giving the information that the certificate is not changed they are not doing SSL interception at the moment, at least for this specific site. If they don't do it because of malconfiguration, site specific exceptions or whatever is unknown.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .