Hi,
I need a Certificate or Subordinate CA [plus Key] with CA attributes, that I can install on my Proxy for outbound SSL connections. So whenever a user wishes to connect to any HTTPS website out in Internet, they don’t get the initial warning from the Web Browser saying ‘Invalid CA’.
Where on here I could get this?
Many thanks
Are you talking about a proxy that MitMs outbound connections from your network? That’s not anything Let’s Encrypt can or will provide, and is definitely beyond the scope of this forum. You’d need to create your own CA, have its root me trusted by devices on your network. That’s the easy part. The hard part will be generating, on the fly, certificates for any domains that are connected to (unless it’s a defined set that you already know.) There are fancy enterprise devices that do this - it’s not a simple problem.
The extra hard part is not causing a total security disaster and also breaking later protocol developments like TLS 1.3.
Yes we are talking on Man in the middle interception, so the user web browser would trust the certificate of the proxy [where the SSL connection is de-encrypted]. Is not this something we could achieve with Let’s Encrypt? Is there any free CA subordinate CA and key provider, as the one we asked for were quoting us 50K for them [QuoVadis].
I’ve heard that some Web Browser doesn’t like very much the local self-signed CA generated on the Proxy [F5]
No, that’s not something Let’s Encrypt can do. They’re a public-trusted CA, and this request is to effectively allow you to issue malicious (even though your intent is not) certificates. That’s counter to the whole idea of Let’s Encrypt. I don’t expect that you’ll find any provider who would do this for free, or even for a low cost. The correct way to do this is to create your own CA which, you’re correct, would not be trusted by browsers by default, but assuming you’re MitMing machines that you actually have the authority to intercept traffic from, you would need to add your CA’s certificate to the trusted root store on those machines.
What you’re attempting to do is not a simple problem, and a much harder thing do do right. Given the level of experience your responses imply that you have with SSL/TLS in general, I would recommend in the strongest possible language that you hire an experienced security professional to help. In today’s world, you should assume that anything set up so insecurely will be broken.
If all of your proxy users are in the same network / active directory, you can try create a CA certificate and push it out to network devices (AD can definitely do that)
Or (What about just don’t use SSL/TLS proxy?Like always on SSL Chrome Extension?)
Thank you
Hi folks,
I can confirm that Let’s Encrypt certificates are technically unsuited to this use, and in some cases it may be cause for revocation of certificates under the Let’s Encrypt subscriber agreement.
The usual way that people do this inside of organizations where the organization controls all of the devices is the way that @stevenzhu mentioned, which is creating your own internal CA and telling all of the devices to trust it. Then an intercepting proxy can generate certificates for each domain that a user tried to access. There are a number of proxy products that can be configured to use an internal CA’s key this way. As @mnordhoff mentioned, this approach can also create new security risks because the intercepting proxy may not understand (or enforce) new cryptographic security measures that get added to Internet protocols over time. There have been various studies by researchers showing that intercepting proxies often didn’t enforce security measures that browsers would have enforced.
For cases where the organization doesn’t control the client devices, we and the browser developers are trying very hard to make sure that this is absolutely impossible and that there will never be a way to do it. We don’t want network operators to have any way to unilaterally intercept TLS sessions, and we would consider any such mechanism to be a complete failure of the TLS security model.
When you say ‘create a CA’ you mean:
Thanx
I mean create a CA else where (on local secured machine) using this tutorial
https://jamielinux.com/docs/openssl-certificate-authority/
Then create an intermediate CA, which put onto the proxy. Then push it(CA & Intermediate CA) to your connected devices that use the proxy
I don’t know the exact process since I never tried this.
But I don’t think it’s a good idea (local key might be compromised and pose a threat on all users in this network)
Thank you
If your proxy is designed for this use, there should be documentation provided by the developer of the proxy about how to create an internal CA, because this is a common configuration. It’s not just a matter of creating one single certificate; the proxy will need to be able to create a new certificate for every site that it intercepts.
Please consult a different forum or documentation for your particular proxy for this. Although we like to share information about PKI technology, Let’s Encrypt and this forum don’t exist to help people create intercepting proxies. All of our services are aimed exclusively at issuance of publicly-trusted certificates for end-entity sites, and never at interception on private networks.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.