1

We're considering implementing an SSL Intercept proxy in my organization. It will perform a SSL MITM to be able to inspect traffic. It will be a solution of a commercial vendor.

It is clear that we will need to inspection exceptions for some sites:

  • Policy (Confidentiality): banking, medical, ...
  • Application: client side certificates based authentication

But what about SSLVPN applications (OpenVPN or commercial solutions)? I suppose they will stop working as although they use SSL encryption, there is no valid HTTP inside of them. However, I didn't find any useful documentation on this.

I could direct my questions to the vendor, but I'm interested into your experience or opinion on the impact of implementing this.

1

You are absolutely correct, when there is no valid HTTP inside of the SSL encryption, a decrypted flow will not work through a SSL intercept proxy.

One of the things you need to do before implementing SSL intercept is that you need to identify SSL based applications that are not http-based to prevent denied access (handling through Whitelist).

I can only speak about SSL intercept on (forward) proxies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.