5

I have a fully controlled environment (routing, DNS, CA, private keys, certificates) between two closed appliances that communicate over HTTPS. The traffic is over a mutual TLS authenticated channel, using Server Name Indication, as well as elliptic curve keys.

I need a tool (or set of tools) which can use my existing client and server private keys and certificates, as well as capable of doing SNI, to "impersonate" the server towards the client, copy/dump decrypted traffic, then relay on the traffic as if coming from the client and vice-versa.

I can't do much against the appliances themselves (such as excluding EC/DH keys, to permit simple decrypting of traffic at a later stage) but I have all the certificates and private keys and I can manually send the traffic where I want, I do not need particular proxying tricks.

I had some moderate success with openssl s_client / s_server + tee into a pipe, but this seems to break after just one connection.

Other tools I have tried either can't handle SNI, or insist on "faking" certificates, which I really do not need or want (especially if the fake certificates do not meet my/app requirements) and are usually more general purpose than my needs.

I am not looking for a commercial grade appliance or software, and I do not need the possible solution to generate certificates. I have them, as well as the private keys.

I need something that can listen on tcp/443 with the provided PK/cert/chain and establish the TLS session, store/dump the unencrypted data, then replay the content received from the client towards the server, in another TLS session using SNI and the provided client PK/cert/chain as closely matching the original as possible. It should be able to handle and relay response data as well on the same TLS session, as well as multiple (as in series, not parallel) connections. I need to capture traffic strictly between the two well known boxes.

  • Apologies - despite having already answered this - which I'll leave because I believe it does answer your question - on second thoughts I've voted to close the question. Posts asking for product recommendations are off topic. – Hector Jan 14 '18 at 22:18
  • 1
    @Hector this question is a little bit harder than you've suggested. OP has stated that TLS sessions are mutually authenticated. Neither Apache/mod_proxy nor any other HTTP[S] reverse proxy software supports client certificate authentication towards backend. – ximaera Jan 14 '18 at 22:54
  • Possible duplicate of SSL MITM and Mutual Authentication - vendor marketplace – ximaera Jan 14 '18 at 22:56
  • Since product recommendations are off topic, then unfortunately I'm not getting anywhere. The theory sounds just fine, having all that I have decrypting / reestablishing a connection should be possible, but alas, I am looking for something more exact on how to achieve my goal (whether "products" or specific usage of tools like openssl) as theory didn't get me any further here. – Zoltán Kelemen Jan 14 '18 at 23:50
  • 1
    @ximaera - good point. I've updated to suggest using mod_headers to get around that. Still - your NGinx solution looks far cleaner. – Hector Jan 15 '18 at 8:31
5

Oh, fine, since 1.7.8, Nginx supports the proxy_ssl_certificate[_key] directives which do exactly what you need. Set up a reverse proxy with server certificate and key paths put into ssl_certificate and ssl_certificate_key directives respectively, and add client certificate and key in a similar fashion via proxy_ssl_certificate and proxy_ssl_certificate_key.

Don't forget to enable client certificate auth via ssl_client_certificate directive. Your client CA certificate should be used for that. Here's one simple tutorial.

SNI is supported by specifying different server directives on the client side, and by adding corresponding proxy_ssl_server_name directives on the proxy side.

P.S. The difference between this question and the one I considered a duplicate of this one is that you don't want to generate client certificates on the fly (which Nginx can't do for you anyway).

  • had to recompile Nginx with lua support for some of the finer details, but indeed, this does serve my puposes. Thanks! – Zoltán Kelemen Jan 15 '18 at 13:54
-1

I'd suggest trying Apache with mod_proxy and mod_dumpio. You could use mod_headers to copy over the client authentication headers - see here.

  • Is this an answer or a comment? – schroeder Jan 15 '18 at 7:14
  • @schroeder - apologies. I've updated the answer - shouldn't have been that lazy. – Hector Jan 15 '18 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.