2

I am using chrome, and when I perform a google search I get the green icon in my browser.

When I click on the icon to see the certificate information, in the 'Connection' tab is says:

"The identity of this website has been verified by proxy.example.com..."

proxy.example.com - replace example with a company name

When viewing the actual certificate is says:

issued to: *.google.com
issued by: proxy.example.com

To me this seems like all traffic is not private anymore, rather the proxy is under control. Is this correct? i.e. it seems as though the connection is SSL and private, but really all traffic is being proxied to google, and the certificate is really just a private SSL issued internally by the company 'example'.

Is this a correct analysis?

| improve this question | |
  • 2
    Yep. That's what's happening. – cpast Apr 23 '15 at 20:37
3

This is a typical setup in companies and is called SSL interception, SSL visibility or something like this. The main idea is that there is nothing which prevents attacks using TLS connections, because TLS only secures the transport and neither the server nor you can make any assumptions about the security of the server or the risk associated with the exchanged data.

Thus to protect the systems against malware or to prevent data leakage you have to look into TLS connections too. The only way to do this is to have some kind of proxy in the middle which intercepts and analysis the data.

Is this secure? It depends: Of course it breaks end-to-end encryption, but only to stop insecure or unwanted content. From the perspective of the company using this products it is definitely more secure to intercept SSL connections than to let data pass without analysis.

| improve this answer | |
  • doesn't this mean that technically with SSL interception your e.g. password can be breached? – cool breeze Apr 24 '15 at 19:21
  • The goal of SSL interception is to look into the unencrypted content. This can of course include password other sensitive data. But, a browser detects man-in-the-middle attacks because it does not trust the new issuer of the certificate. Only if this issuer is imported as trusted the interception can be done transparent to the user. Importing the proxy CA as trusted is usually done company wide, but if you install your own browser or use your own computer within the companies LAN you will get the SSL warnings. – Steffen Ullrich Apr 24 '15 at 19:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.