Suppose that there is a http proxy server outside the firewall of an organization hosting a web server. All client connections to the web server happen through this proxy. The client negotiates SSL with the proxy server and connections terminate at the proxy. Since the proxy is deployed outside the firewall, there are chances of its certificates and private key getting compromised. How is this problem prevented in proxy servers?
What you describe is not what is usually called a "proxy". The normal "proxy" is a machine which is close to the client, not the server; communications between the client and the proxy are not normally encrypted (they can be, but that's rare); and when the target server uses HTTPS, then the SSL is between the client and the server, the proxy seeing only the encrypted flow.
(There are setups in some organizations where the proxy does the SSL itself, as the client; such a proxy also rewrites URL in Web pages so that clients see only
http:// URL, not
In any case, it would be wrong to think of firewalls in such a clear-cut way. A firewall does not ensure absolute security. Similarly, a machine with no firewall is not a free-for-all. A firewall is really a method to cope with sloppy administration on the machines themselves: it blocks access to some ports when the server to protect listens to these ports, while it should not.
The nicer way to say it is that a firewall simplifies administration since it allows blocking incoming connections at a single unified place instead of requiring strict regulation on each machine. Yet, a well-administered server needs no firewall to be secure.
Organizations often have a separate internal dmz, where services such as the proxy server is available for the clients inside the organization.
This is however not entirely outside the firewall, but in a security zone with the appropriate firewall policy and often ips.
There are many reasons for such a design, and the most important one is that servers on this dmz should not be able to reach internal services, but less restrictions are put on outbound connections.
If the proxy server is compromised, the sll certificate is also compromised.
The defense is to have a decent firewall policy to protect the administrative services + traffic, audit the proxy logs and to keep the patches up to date.