I am researching the Equifax breach described here: https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
Apparently the attack went undetected for a long period of time and the main reason given for this are expired certifiates: Because of expired certificates, the Equifax IPS was unable to inspect encrypted traffic and detect the breach in time.
-- Edit, based on Steffen Ulrich`s response below --
Page 34 of the report gives some more details:
The expired SSL certificate was installed on a traffic monitoring device called an SSL Visibility (SSLV) appliance.195 This device allowed Equifax to inspect encrypted traffic flowing to and from the ACIS platform by decrypting the traffic for analysis prior to sending it through to the ACIS servers.196 Both the intrusion detection system and the intrusion prevention system were behind this monitoring device.
And further below on the same page:
The default setting for this device allowed web traffic to continue through to the ACIS system, even when the SSL certificate was expired. When this occurs, traffic flowing to and from the internet is not analyzed by the intrusion detection or prevention systems because these security tools cannot analyze encrypted traffic. According to documents obtained, the SSL certificate installed on the SSLV device monitoring the ACIS domain ai.equifax.com expired on January 31, 2016. As a result, Equifax did not have visibility into the network traffic in the ACIS environment for nineteen months
-- end of edit --
According to my research it should still be possible to decrypt data, even with an expired certificate. Consider for example this post here: https://stackoverflow.com/questions/28098470/no-error-encrypting-decrypting-data-with-an-expired-certificate-using-rsacrypt
I am not that familiar with IPS products and respective configuration possibilities, so I am a bit confused: What exactly is the issue with the expired certificate? Is the IPS checking the validitiy and in case the cert. is expired just refuses to decrypt traffic? If so it seems to be, that there should at least be an option to decrypt anyway and issue a warning to the whoever´s running the IPS. Is there such a thing?
Thanks for you insight and cheers