Say that I have a program that needs to communicate with my own server.
I use TLS to secure the connection, however the program is running within a network, which sends all TLS traffic through a TLS inspection proxy and the computer where the program runs trusts the CA certificate of the TLS inspection proxy.
Everything works, however the proxy on the TLS inspection server has access to plaintext sent between my program and my server.
To prevent this I thought that we could wrap the plaintext as follows:
- The plaintext is wrapped inside a TLS session (inner)
- This TLS session is then wrapped inside another TLS session (outer)
With this setup the TLS inspection proxy will only terminate and replace the certificate for the outer TLS session but not the inner session, and thus the server will not have access to the plaintext. (Assuming the TLS inspection software doesn't do this recursively).
My program could then use the computers default root store for verifying the outer session, but either bundle its own trusted root store for the inner session or use certificate pinning for the inner session. The server would also need to be modified to use this double-TLS.
Of course after installation of my program a user could modify the trusted root store used for the inner session, by modifying the compiled program, but I think this is not a very likely scenario.
Are there any other flaws with this approach?