0

I was wondering if there is any utility for multiple hosts sharing the same TLS session key. I have come across proxies and the way they intercept TLS connections is to make the client accept its certificate and then act as client to the end server. This can be problematic with applications that do certificate pinning. If the proxy and the client shared the same session key (a secure key distribution happening post-handshake) then the client could share the session keys to all the hosts it trusts and that way the proxy/proxies could decrypt the intercepted messages. Is this a bad idea?

Improve this question

1 Answer 1

Reset to default
4

Sharing the same TLS session key among multiple hosts, including proxies, is generally considered a bad idea from a security perspective.

Instead of sharing the TLS session key, a better approach is to use a trusted proxy that acts as an intermediary between the client and the server. The proxy can establish separate TLS connections with the client and the server, decrypting and re-encrypting the traffic as needed. This allows the proxy to perform its functions while still maintaining the security of the end-to-end encrypted communication.

If certificate pinning is a concern, it can be addressed by configuring the client application to trust the proxy's certificate in addition to the pinned server certificate. This allows the proxy to intercept and decrypt the traffic while still maintaining the trust relationship between the client and the server.

Improve this answer
3
  • What if the application implements certificate pinning? Aren't there cases where pinning occurs in the application itself, so trusting the proxy is not as simple as adding the proxy's certificate to the trust store since the application is expecting only the end server's certificate? Also with regard to sharing the TLS session key, I was wondering if there are any secure key distribution mechanisms to mitigate the security issue.
    – imawful
    Commented Mar 20 at 0:40
  • Yah, when an application implements strict certificate pinning, it expects to communicate directly with the end server and validates the server's certificate against a predefined set of pinned certificates. If a proxy attempts to intercept the connection, the pinning check will fail because the proxy's certificate does not match the expected pinned certificate. Modifying the application code to disable or relax the certificate pinning might be the best option here.
    – CaffeineAddiction
    Commented Mar 20 at 4:33
  • Yeah but is there any solution that does not involve modifying the application code? Since the application would be end users with a third party proxy being used? The proxy should work for all without making modifications to the application code. Is this possible?
    – imawful
    Commented Mar 20 at 14:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .