2

I am using chrome, and when I perform a google search I get the green icon in my browser.

When I click on the icon to see the certificate information, in the 'Connection' tab is says:

"The identity of this website has been verified by proxy.example.com..."

proxy.example.com - replace example with a company name

When viewing the actual certificate is says:

issued to: *.google.com
issued by: proxy.example.com

To me this seems like all traffic is not private anymore, rather the proxy is under control. Is this correct? i.e. it seems as though the connection is SSL and private, but really all traffic is being proxied to google, and the certificate is really just a private SSL issued internally by the company 'example'.

Is this a correct analysis?

1
  • 2
    Yep. That's what's happening.
    – cpast
    Apr 23, 2015 at 20:37

1 Answer 1

3

This is a typical setup in companies and is called SSL interception, SSL visibility or something like this. The main idea is that there is nothing which prevents attacks using TLS connections, because TLS only secures the transport and neither the server nor you can make any assumptions about the security of the server or the risk associated with the exchanged data.

Thus to protect the systems against malware or to prevent data leakage you have to look into TLS connections too. The only way to do this is to have some kind of proxy in the middle which intercepts and analysis the data.

Is this secure? It depends: Of course it breaks end-to-end encryption, but only to stop insecure or unwanted content. From the perspective of the company using this products it is definitely more secure to intercept SSL connections than to let data pass without analysis.

2
  • doesn't this mean that technically with SSL interception your e.g. password can be breached? Apr 24, 2015 at 19:21
  • The goal of SSL interception is to look into the unencrypted content. This can of course include password other sensitive data. But, a browser detects man-in-the-middle attacks because it does not trust the new issuer of the certificate. Only if this issuer is imported as trusted the interception can be done transparent to the user. Importing the proxy CA as trusted is usually done company wide, but if you install your own browser or use your own computer within the companies LAN you will get the SSL warnings. Apr 24, 2015 at 19:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .