I am in an office with a connection that is routed through a BigIP firewall, with SSL interception; our computers have a root certificate to permit the intercept certs. If I browse to a site such as https://www.google.com/ and view the security certificate, I see the certificate issued by the firewall, but browsers merrily accept it because it maps to a root cert on the computer.
I have a VPN connection that is tunneled around the firewall; the certificate used in the VPN negotiation is the expected VPN server certificate, indicating that the firewall is not intercepting this connection. When connected, all my traffic is routed over the VPN, and HTTPS traffic displays the proper site certificates instead of the firewall certificate, indicating that my HTTPS traffic is no longer being intercepted.
Every so often, the VPN server momentarily drops connection (OpenVPN shows that it's renegotiating the connection, then reconnects within 3-5 seconds). What happens to any AJAX/other background HTTPS requests that run while this is happening? The connection never seems to miss a beat (updated data continues to refresh on the page), suggesting that traffic continues flowing even while the VPN connection is down.
Does the browser renegotiate the HTTPS connection momentarily (and transparently) using the firewall certificate while the VPN connection is down? Or does the firewall somehow see that the data is part of an existing connection and pass the data without MITMing it? Or do the AJAX calls actually get rejected because of the certificate change-up, and the page is just continuing to refresh stuff it picked up before the drop so it only feels continuous to me?
- Platform: Windows 7
- Tunnel: OpenVPN server, with OpenVPN GUI client
- Browser: Google Chrome (and sometimes Mozilla Firefox)
- Firewall: f5 BigIP, possibly AFM
This is not a question about whether bypassing a firewall with a VPN is (moral, ethical, legal, etc); this is a question about what happens to data when the VPN drops momentarily, and whether it may be subject to interception. I have authorization to do this specifically because of legal implications.