0

In the interests of validating my thinking:

I’ve been looking at commercial man-in-the-middle (MITM) appliances. It seems like the major players in the marketplace don’t support client certificates and mutual authentication. Basically, available MITM appliances are not capable of generating and signing a client cert trusted by the server.

I am wondering if a properly motivated developer could design a MITM appliance that could both generate new server certificates that respond to Client Hellos (this capability is well-known), as well as generate new client certificates that respond to Client Certificate Requests. If my understanding is correct, the entire SSL session would be distinct on either end of the MITM device.

Am I missing anything here? Assuming that both the client and server trust certificates signed by the MITM, is it possible to MITM SSL mutual authentication with client certificates? On another note, would this requiring breaking TCP sessions?

Thanks for any responses!

Improve this question
1
  • I don't think it is a particular realistic case to assume a third party server would trust a interception-CA. This only works for the server certificate because the clients are in the organizational control. So using a fake client cert against server only works if the server is also under the control. What does work is if the clients expose the client keys.
    – eckes
    Commented May 15, 2017 at 19:35

1 Answer 1

Reset to default
1

If both client and server would trust the MITM proxy then it would be possible to use faked certificates (issued by the MITM proxy) on both sides which are dynamically generated based on the original certificates send by server and client.

But in practice SSL inspection is usually used inside a perimeter firewall to protect clients inside the company. In this case the company has control of the clients and can make sure that all clients trust the CA of the MITM proxy. But, the company has usually no control of the servers and thus cannot make these trust the MITM proxy CA. Thus the servers will usually not accepting the faked client certificate which means that client certificates will not work. And since because of this problem there is usually no demand for this feature it is not implemented, although it would be possible in theory.

Improve this answer
2
  • I was also looking for the same information and I am wondering wouldn't it be possible to approach it in the following manner: MITM proxy intercepts the traffic and mirrors it. Original traffic is not decrypted and hence the user is authenticated using certificate without any problem. And mirrored traffic is decrypted and we can do the inspection of the mirrored traffic. If we notice something and in the decrypted traffic we can terminated that original sessions that's not decrypted.
    – Roman_T
    Commented Nov 11, 2022 at 8:39
  • @Roman_T: "MITM proxy intercepts the traffic and mirrors it" - if a client certificate is needed to access the information then the MITM proxy will not be able to mirror the content from the server - since the proxy does not have the requested client certificate.
    – Steffen Ullrich
    Commented Nov 11, 2022 at 8:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .