2

In my organization, we have an SSL MITM (Man-in-the-middle) proxy (like ZScaler proxy). If I browse an HTTPS website and check the certificate, I can see that the proxy has issued a separate certificate for the site(means the original certificate chain is replaced). I am not getting any alert in my browser because I think the organization has added the proxy's root certificate as a trusted party in my browser / OS.

My question is: Can we trust an SSL MITM proxy for exchanging confidential information (say bank transactions)? I believe that the organization can snoop if they want to as there is not a single end to end SSL connection (There are two I guess - one from my system to proxy and another one from proxy to the original website).

I understand that if the proxy has not replaced the certificate chain, the traffic is secure even through proxy; but here that is not the case. Can you please let me know. Thanks in advance.

  • 1
    It is unclear for me what you really ask about. You seem to understand the concept of such an MITM proxy and you seem to understand that the employer can decrypt and analyze the SSL traffic with such a proxy. What exactly do you mean with "rely on it" then? Rely on it to protect your traffic from your employer - obviously not given how it works. Rely on it to secure your traffic anyway - only as long as you trust your employer and the IT administrators. – Steffen Ullrich Sep 3 at 10:22
  • What I meant is if the organization can snoop sensitive data or not. – SRaj Sep 3 at 12:47
  • Sure they can, getting access to the unencrypted traffic for analysis is the whole point of SSL interception. The question is not if they can get access (they do) but if they will misuse this access (i.e. not only analyze for malware but also grab your passwords). – Steffen Ullrich Sep 3 at 14:01
  • Thanks Steffen. I understand it now. – SRaj Sep 3 at 14:32
2

It should be secure overall, but it's not as secure as a direct communication (endpoint <-> website) would be, because there is another section that could get compromised (endpoint <-> proxy <-> website) by the attackers and leak your data.

If they want to, they can snoop on everything you are doing and you have agreed to that by signing your work contract.

I am not a legal expert here, but where I am from if you would intercept and monitor bank transactions for any of the employees, the organization can get into serious legal trouble, that's why when SSL MITM proxy is setup we have to whitelist financial sector domains. You should read up on laws about that in your country.

  • Thanks Raimonds. One article which I came across: help.zscaler.com/zia/about-ssl-inspection. But they are not saying clearly if they can see the data or not, but from their description, it seems that is possible. – SRaj Sep 3 at 12:51
  • @SRaj it is possible, the way each of these products display information on the UI about data intercepted can be different although. For example some try to obfuscate sensitive data because of GDPR. – Raimonds Liepiņš Sep 4 at 7:18
  • Thank you. Understood it now. – SRaj Sep 5 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.