1

We're considering implementing an SSL Intercept proxy in my organization. It will perform a SSL MITM to be able to inspect traffic. It will be a solution of a commercial vendor.

It is clear that we will need to inspection exceptions for some sites:

  • Policy (Confidentiality): banking, medical, ...
  • Application: client side certificates based authentication

But what about SSLVPN applications (OpenVPN or commercial solutions)? I suppose they will stop working as although they use SSL encryption, there is no valid HTTP inside of them. However, I didn't find any useful documentation on this.

I could direct my questions to the vendor, but I'm interested into your experience or opinion on the impact of implementing this.

1 Answer 1

1

You are absolutely correct, when there is no valid HTTP inside of the SSL encryption, a decrypted flow will not work through a SSL intercept proxy.

One of the things you need to do before implementing SSL intercept is that you need to identify SSL based applications that are not http-based to prevent denied access (handling through Whitelist).

I can only speak about SSL intercept on (forward) proxies.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .