Is it possible to get logins over https when I have full control of the network?

For example, all communication at my work goes over the company firewall and I often connect to my personal server that uses TLS.

If I understand correctly, when I connect to my server, first the handshake is done, then the key exchange is accomplished, and then all communication is encrypted. So all what I will do, like logging in, is encrypted with that key. And if someone sniffs for packets, he will see only encrypted communication.

But it is the same story if someone "owning" network? And as a middleman, steal this key? Can he use it? Can he use it for decrypt this communication?

What I know about this topic is that someone can be middleman and change routing of website and "push" me fake website.


The rule is that you cannot protect a system against its administrator.

If the security team has installed a Deep Packet Inspection on the firewall, and an associated certificate on your client machine, you have full encryption between the client and the firewall, full encryption between the firewall and the server, but everything can be consulted as plain text in the firewall.

The implementation principle is that the firewall uses its master certificate to pretend being your server with a forged certificate. As your client trusts the master certificate of the firewall (the key is here) it accepts to establish the connection. Then the firewall opens another connection to the server and just passes all packets after inspecting them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.