I am using mitmproxy to intercept HTTPS connections from my client device to a third party server. In order for mitmproxy to intercept SSL requests, I need to install a trusted root certificate on my device.

Is there a way for the server to know that requests have been intercepted? Can the server see the details of the custom root certificate? For example if the name is "mitmproxy", can the server see that?

  • The server you're forwarding the connection to isn't going to see the proxy's certificate unless it requests a client certificate. For typical web traffic on the server sends a certificate to the client. Your proxy will be the client to the 3rd party server. – RoraΖ May 8 '15 at 14:07

Is there a way for the server to know that requests have been intercepted?

No, because the communication with the server does not use the custom-installed MITM certificate. That certificate is only used by the client when communicating with the proxy.

[Client] <=========================> [Proxy] <=======================> [Server]
           Connection using fake               Connection using real
           user-installed cert/key             server cert/key

The server only knows that it is communicating with some client. The server has no idea that that client is actually a proxy acting on behalf of another client. The proxy-to-server connection is a perfectly genuine HTTPS connection, using the server's real key and certificate.

The connection between the client and the proxy is where something fishy is going on. The proxy knows that the certificate isn't genuine, but the proxy is controlled by the person orchestrating the MITM attack, so that's perfectly reasonable.

| improve this answer | |
  • Also note that with mutual authentication (i.e. the server expects a Client Certificate, and the client provides it), the server can actually detect that a MitM has taken place. This of course only applies if the expectation is valid. – Lekensteyn Jul 7 '15 at 18:14

A Man-in-the-Middle attack really is double impersonation: the attacker poses as a fake client when talking to the server, and as a fake server when talking to the client. In a SSL context, this means that there are two completely distinct handshakes: one between the attacker and the client, and one between the attacker and the server. Details about what happens in one handshake, including whatever certificates where exchanged, have no impact on the other one (and vice versa).

The MitM runs both impersonations at the same time because it wants to reuse data elements from both the client and the server. Typically, the attacker wants the user's password; the attacker could then just emulate a fake server and never talk to the true server (then it would be simple impersonation), but the attacker finds it convenient to simultaneously talk to the true server, because this makes it easier to offer a convincing emulation of the server to the client.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.