What tool(s) can be used for MitM in a controlled environment to decrypt+relay HTTPS over MTLS traffic with SNI?

Question

I have a fully controlled environment (routing, DNS, CA, private keys, certificates) between two closed appliances that communicate over HTTPS. The traffic is over a mutual TLS authenticated channel, using Server Name Indication, as well as elliptic curve keys.

I need a tool (or set of tools) which can use my existing client and server private keys and certificates, as well as capable of doing SNI, to "impersonate" the server towards the client, copy/dump decrypted traffic, then relay on the traffic as if coming from the client and vice-versa.

I can't do much against the appliances themselves (such as excluding EC/DH keys, to permit simple decrypting of traffic at a later stage) but I have all the certificates and private keys and I can manually send the traffic where I want, I do not need particular proxying tricks.

I had some moderate success with openssl s_client / s_server + tee into a pipe, but this seems to break after just one connection.

Other tools I have tried either can't handle SNI, or insist on "faking" certificates, which I really do not need or want (especially if the fake certificates do not meet my/app requirements) and are usually more general purpose than my needs.

I am not looking for a commercial grade appliance or software, and I do not need the possible solution to generate certificates. I have them, as well as the private keys.

I need something that can listen on tcp/443 with the provided PK/cert/chain and establish the TLS session, store/dump the unencrypted data, then replay the content received from the client towards the server, in another TLS session using SNI and the provided client PK/cert/chain as closely matching the original as possible. It should be able to handle and relay response data as well on the same TLS session, as well as multiple (as in series, not parallel) connections. I need to capture traffic strictly between the two well known boxes.

Answer 1

Oh, fine, since 1.7.8, Nginx supports the proxy_ssl_certificate[_key] directives which do exactly what you need. Set up a reverse proxy with server certificate and key paths put into ssl_certificate and ssl_certificate_key directives respectively, and add client certificate and key in a similar fashion via proxy_ssl_certificate and proxy_ssl_certificate_key.

Don't forget to enable client certificate auth via ssl_client_certificate directive. Your client CA certificate should be used for that. Here's one simple tutorial.

SNI is supported by specifying different server directives on the client side, and by adding corresponding proxy_ssl_server_name directives on the proxy side.

P.S. The difference between this question and the one I considered a duplicate of this one is that you don't want to generate client certificates on the fly (which Nginx can't do for you anyway).

Answer 2

I'd suggest trying Apache with mod_proxy and mod_dumpio. You could use mod_headers to copy over the client authentication headers - see here.