In the interests of validating my thinking:
I’ve been looking at commercial man-in-the-middle (MITM) appliances. It seems like the major players in the marketplace don’t support client certificates and mutual authentication. Basically, available MITM appliances are not capable of generating and signing a client cert trusted by the server.
I am wondering if a properly motivated developer could design a MITM appliance that could both generate new server certificates that respond to Client Hellos (this capability is well-known), as well as generate new client certificates that respond to Client Certificate Requests. If my understanding is correct, the entire SSL session would be distinct on either end of the MITM device.
Am I missing anything here? Assuming that both the client and server trust certificates signed by the MITM, is it possible to MITM SSL mutual authentication with client certificates? On another note, would this requiring breaking TCP sessions?
Thanks for any responses!