I have Security Onion installed and doing full packet capture on my home network. I also have a firewall (pfSense) which does my routing. I have Security Onion sitting just behind my firewall and mirrored from a switch. It works great except I want to decrypt my SSL traffic. I would very much prefer to have the decryption take place on the fly instead of manually decrypting with wireshark that way Snort sees everything as well. I installed squid on the firewall to try to proxy my traffic but it is not working right. It forwards everything on but I can't get it to decrypt (run live capture on the firewall and it is still encrypted). If I can get this working, will that be enough (using the firewall's private key to decrypt)? If so, how would I go about setting this up in Security Onion? Thank you for your help.

To set up general TLS decryption Security Onion will need to have a certificate trusted by your endpoints. Usually this certificate has a CN of * so it can sign anything.

So you'd generate a TLS keypair for encryption. Its cerificate will need to be added to your root store either on your ActiveDirectory Domain Controllers, some other central store for other systems, or in the individual endpoints. This keypair will allow Security Onion to act as a TLS proxy yet still be able to be trusted by endpoints.

The firewall cert is unrelated as TLS is end-to-end encryption where the server has the private key and no one else. TLS decryption subverts this by introducing a proxy that can decrypt, inspect, and re-encrypt TLS traffic. This only works if the certificate used for re-encryption is trusted by the endpoints. It is a controlled MitM.

CAUTION: This is very dangerous if done improperly since it can enable malicious MitM if the keypair is stolen.

  • Note that my answer only works if the decrypting proxy is inline (it can't act as a proxy otherwise). The firewall still won't see unencrypted traffic. Given the way keying works in TLS it isn't practical to decrypt mirrorred traffic. – Alain O'Dea Jul 1 '15 at 21:51

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.