In this environment an intercepting HTTPS proxy is used for legitimate purposes and its CA root certificate is installed on all clients. Every HTTPS proxy solution I've seen so far simply signs a new certificate directly with the CA, not preserving any information on the original certification path. After the proxy has made its decision, it's impossible to see what the original certification path was, which would be helpful for further evaluation in both success and failure.
It would be possible for the proxy to recreate the whole path of fake certificates instead of the one fake certificate, as demonstrated in this matrix on row "proposal". Of course, examining these certificates in detail would be rather useless, as they have fake keys, but this would preserve information on their
CN, the dates they are valid between etc.
What might be the main reason we don't see this?
- It's assumed that users won't examine the certificate anyway.
- The additional resources this would consume on the proxy.
...or do we? Any examples of such intercepting proxies?
Would there be a better alternative, if we would like to preserve this information for the client?