How is data decryption handled with proxy devices in perimeter networks (DMZ) in companies? Let's assume we host hundreds of web sites on our DMZ servers, how can we get the data decrypted or even first authenticate the server to the external client connecting from Internet ? I cannot imagine that Symantec , GoDady etc. would provide us with a Root CA for our proxy device for certificate resign, so how can a proxy by used in such cases ?


The CA will not provide you with a certificate for a proxy. They will also not provide you with a certificate for a specific server. They will just provide you with a certificate matching a specific hostname (or multiple names). Where you use this certificate is up to you (some CA might restrict this). You might even use the same certificate on multiple system.

This means for your case that you could use the same certificate both on the proxy and on the final server, i.e. terminating the TLS traffic at the proxy and then having another TLS connection with the same certificate to the real server. But you could also terminate the TLS traffic at the proxy with the certificate issued by the public CA and then use a different certificate for the real server by using your own PKI which is trusted by your proxy. Or, if the connection to the real server from the proxy is considered protected by other means (like IPSec) you could also use plain traffic without TLS to connect from the proxy to the real server.

By terminating the TLS connection in the proxy the proxy has access to the plain text and can also make changes to the traffic, like requesting authentication, filtering traffic in a WAF etc.

  • Thank you. So when we get our external certificates from Symantec I would have to get certificate that contains the private key and upload it to the proxy as well, right? I mean the same that is already on the server? – adam86 Jan 1 '18 at 17:39
  • 1
    @adam86: yes, the certificate of the public CA is used to terminate the TLS connection from the client at the proxy. – Steffen Ullrich Jan 1 '18 at 18:04
  • Thank you. So it's nothing else than a manual process in the end? I mean, get tech certificate from each server and upload it to the proxy. – adam86 Jan 1 '18 at 18:28
  • 1
    @adam86: essentially that's it. Of course it is not just upload but you need to configure the proxy to use the certificate and also to forward traffic to the real server. – Steffen Ullrich Jan 1 '18 at 18:42
  • You will want to avoid transmitting the public key if possible (by generating a keypair on the proxy and getting a CSR signed without transmitting the private key). – jrtapsell Jan 1 '18 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.