I have the following question regarding the decryption of SSL traffic. The topology that I have in mind is like this: User-------MitM Proxy--------WebServer In the environment described earlier there is already a commercial proxy which is doing a man in the middle attack by replacing the original SSL certificate of the server with it's own. Can I decrypt the SSL traffic between the user and the proxy and send them un-encrypted to a forensics/sandbox solution? I have a tap device between the users and the proxy and the public and private key of the mitm proxy are available.
EDIT : If the proxy SSL certificates are already installed on the user computer then yes absolutely and here's the right answer. Otherwise keep reading...
Yes and no.
No because by replacing the SSL certificate of the server by your own, the user's browser will raise a big scary warning that the certificate is invalid and will warn the user that he should not proceed.
Yes because if the user still decide to proceed and accept the false certificate, then you will be able to decrypt everything since it was encrypted with your certificate.
If you are able to install your certificate directly on the user computer, then his browser will not raise any warning and you can decrypt everything. Check this link
Just replace the https by http. Most users don't take the time to check that it's really https so it's a very effective MitM attack.
Get a real certificate for a url that is similar to the url you are targeting.
As Andrey points out in the comments; this is only valid if the user machine already trusts the replacement SSL cert (more accurately, the proxy cert as a root cert or the proxy cert signed by a trusted root), otherwise the user will get a warning that the cert is signed for the wrong domain. In a corporate setting, the proxy cert is typically installed by a group policy by the domain admins.
Yes, absolutely. If your MitM proxy is already replacing the SSL certificate, you should be able to decrypt the traffic using the private key of the MitM proxy. Just capture the packets as if they were unencrypted (using wireshark or something) and unencrypt them at your leisure.