1

Our company connects to an external service through an outdated library (using a PHP extension for an older version of PHP). As this requires us to have a server setup in isolation for this service, I have reached out to the company to ask if there is any chance of a newer version of their extension but unfortunately not at this stage.

The extension uses a known and shared client certificate (for all clients) with a different certificate password per client.

I am interested to see how the protocol works so that we could potentially develop our own library for it using modern technologies, however due to the mutual authentication I am not sure how to go about snooping on the traffic.

For argument's sake, let's say that the service we are connecting to is example.com (note that the server is also SSL authenticated). If we have been given a shared client certificate and a client-specific password, is it possible to snoop on this traffic, and how could we do this?

The extension specifically requires a Linux OS, so where possible, it would be very helpful if the solution or suggestions could be tailored to that environment.

2

You may want to take a look to ReverseEngineering.SE as there may be some more practical information there. I also recommend you to check your product license and get some legal advise: while reverse engineering is usually considered a fair practice (from a legal perspective) when it comes to ensuring software compatibility, it is often a grey area and you may not want to put yourself or your company into trouble.

Your application is using SSL mutual authentication, which means that the server authenticate itself to the client, the client authenticate itself to the server, and the communication between both is ciphered.

What you need is called SSL interception.

This is basically done using some form of proxy which will fake server's identity to the client, fake client's identity to the server, and have access to the communication in clear form in between.

Normal communication:

CLIENT >client_cert>---------------------------------<server_cert< SERVER


Communication intercepted by a proxy:

CLIENT >client_cert>------<fake_server_cert< PROXY >client_cert>------<server_cert< SERVER

Fake server's identity to the client

This is usually done by installing a CA certificate you control (ie. one you created yourself and for which you have the associated private key) on the client.

Then install this CA certificate on the proxy with the associated private key. Now any certificate that the proxy will generate and sign using this CA will be trusted by the client. In particular, the proxy will be able to generate new certificates bearing the genuine server name, effectively spoofing its identity.

Note that there are measures that the client can take to detect that the certificate sent by the proxy is not the actual server's certificate, but if you are lucky (ie. if the developers did not take any specific step to harden their application) such measure will not be implemented.

Fake client identity to the server

As you have no control over the server, you therefore need a genuine client certificate with its associated private key. Fortunately, according to your post it seems that you have them, so it should be possible to install one of these client certificates on the proxy to make it able to identify itself as a genuine client against the remote server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.