I've read the various questions tagged [ssl] and [mitm] and [proxy] and I couldn't find a duplicate. I cannot find any documentation on this subject online.

All of the traffic is currently flowing through the firewalls, from here if it is port 80 or 443 then it is being pushed through to a web filtering system. The WEb Filtering system currently does SSL inspection, but the firewalls don't. What would be the impact if I performed SSL Decryption at both the firewall level, and also at the Web Filtering level ?

Would the target URL be aware that multiple SSL Interceptions have happened?



Would the target URL be aware that multiple SSL Interceptions have happened?

In theory the target URL is not aware of SSL interception at all, no matter how many SSL interceptions you do. It only sees that it is doing the SSL handshake with some kind of client and can not see if it is doing the handshake directly with the browser or with some SSL interception device.

In practice it might be possible to detect an SSL interception device by the use of different ciphers or different cipher order or different protocol versions compared to the browser. Or it might be possible to detect interception by some other non-browser features, like accepting certificates the browser would not. But in this case only the device nearest to the server can be detected this way and further devices not, because they don't do SSL handshakes with the server directly.

  • Some Government sites, they can see if a MITM attack has happened no? – KingJohnno Apr 8 '15 at 14:44
  • @KingJohnno: I see nothing which would make government sites able to detect SSL interception in a way other sites could not. Which special capabilities do you have in mind? – Steffen Ullrich Apr 8 '15 at 14:52
  • If the SSL certificate is signed by a body that isn't a 'trusted' one then I have had problems in the past. We are getting slightly of topic here. If I decrypted the traffic twice, would I be causing myself a needless headache? – KingJohnno Apr 8 '15 at 15:05
  • 1
    The browser would still need to trust the proxy CA for the SSL interceptor nearest to the browser, so no change here. But this SSL interceptor would then need to trust the CA of the next SSL interceptor in the chain which usually means that it needs to have a special setup. – Steffen Ullrich Apr 8 '15 at 15:07
  • Ideal. Is there any documentation online about how to do this ? – KingJohnno Apr 8 '15 at 15:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.