We're considering implementing an SSL Intercept proxy in my organization. It will perform a SSL MITM to be able to inspect traffic. It will be a solution of a commercial vendor.
It is clear that we will need to inspection exceptions for some sites:
- Policy (Confidentiality): banking, medical, ...
- Application: client side certificates based authentication
But what about SSLVPN applications (OpenVPN or commercial solutions)? I suppose they will stop working as although they use SSL encryption, there is no valid HTTP inside of them. However, I didn't find any useful documentation on this.
I could direct my questions to the vendor, but I'm interested into your experience or opinion on the impact of implementing this.