1

I have a 1st generation iPad, and I usually use it for web browsing when I'm home. The 1st gen iPad can't run newer versions of iOS (I'm stuck with iOS 5). I went to a website that tells if your SSL client is good or bad. My iPad has a bad SSL client. I have a computer that I use as a personal home server. The server has a good SSL client. I was wondering if I could connect my iPad to that server, and then the server would encrypt the connections for me. What I want to do is to use the computer as something like a proxy server, and the connections between the iPad and my proxy could be unsafe, because I trust my home network, but the connection between the proxy and the web would be safely encrypted. I tried using the Squidman proxy server, but I went to that website again and it told me that the SSL client was bad. So I think that perhaps the Squidman proxy server doesn't do the whole encryption process, and it leaves this job for the iPad SSL client, which is bad. How could I have a proxy server that handles the SSL encryption?

0

Essentially, you're looking to conduct a man-in-the-middle attack against yourself. Squid newer than 3.1 offers a feature called sslbump that can perform this technique, where connections are decrypted then re-encrypted. You can use dynamic certificate generation to make certificates that match the hostname correctly, but you'll need to install the Certificate Authority from Squid on your iPad.

Now that I've answered your question, I'll go for the intent -- you're trying to make yourself more secure, but I'm not convinced you are. Did the SSL test site list specific attacks that your client is vulnerable to? What threats are you concerned about? Keep in mind that by proxying your connection, you're adding more complexity, and thus more attack surface, to your setup. If your proxy server gets compromised, then 100% of your traffic will be readable by the attacker. Also, you'll get no benefit from this setup if your iPad is not on your home network.

  • Thanks for the answer David! Well, I am still learning about IT security, so I am no expert. I don't "understand" the specific attacks that my client is vulnerable to. Anyways, the website is "howsmyssl.com", and it tells me that my client supports cipher suites that are known to be insecure, and it supports compressing the settings that encrypt the connection. I don't quite understand what these vulnerabilties mean. – DanielNogueira97 Jun 16 '14 at 17:41
  • Unfortunately I can't update the software, so I was thinking of using other solutions to protect my connections. I have this server available, and have full control of it. That proxy server thing I wanted to do was an idea to protect my connections. You pointed me some possible problems with my idea... Do you know any other good solutions for protecting those connections? – DanielNogueira97 Jun 16 '14 at 17:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.