0

In the interests of validating my thinking:

I’ve been looking at commercial man-in-the-middle (MITM) appliances. It seems like the major players in the marketplace don’t support client certificates and mutual authentication. Basically, available MITM appliances are not capable of generating and signing a client cert trusted by the server.

I am wondering if a properly motivated developer could design a MITM appliance that could both generate new server certificates that respond to Client Hellos (this capability is well-known), as well as generate new client certificates that respond to Client Certificate Requests. If my understanding is correct, the entire SSL session would be distinct on either end of the MITM device.

Am I missing anything here? Assuming that both the client and server trust certificates signed by the MITM, is it possible to MITM SSL mutual authentication with client certificates? On another note, would this requiring breaking TCP sessions?

Thanks for any responses!

  • I don't think it is a particular realistic case to assume a third party server would trust a interception-CA. This only works for the server certificate because the clients are in the organizational control. So using a fake client cert against server only works if the server is also under the control. What does work is if the clients expose the client keys. – eckes May 15 '17 at 19:35
0

If both client and server would trust the MITM proxy then it would be possible to use faked certificates (issued by the MITM proxy) on both sides which are dynamically generated based on the original certificates send by server and client.

But in practice SSL inspection is usually used inside a perimeter firewall to protect clients inside the company. In this case the company has control of the clients and can make sure that all clients trust the CA of the MITM proxy. But, the company has usually no control of the servers and thus cannot make these trust the MITM proxy CA. Thus the servers will usually not accepting the faked client certificate which means that client certificates will not work. And since because of this problem there is usually no demand for this feature it is not implemented, although it would be possible in theory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.