I would like to know if a CA Cert I installed can be used to perform DPI-SSL decryption without my knowledge. Would there be any indication? Can you look at the cert properties to determine if it can be used for this purpose?


DPI-SSL works by doing a man in the middle attack: it frames the right server by dynamically generating a fake certificate for that server. This works only if the corresponding CA (the one which issues the fake certificate on-the-fly) is "trusted" by the client. By definition, this CA "looks like" any other CA It is different from the "normal" CA only in that the private key is owned by some system which does the DPI, but this is not written on the certificate itself.

What you can do is compare the certificates that your machine trusts with that from the "root CA" store of a generic desktop system; compare the "thumbprints" (these are the hash values computed over the root certificates themselves). Presumably, the default root CA are not involved in DPI; any extra certificate is then a potential suspect.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.