I\'m looking into using mitm-proxy, but part of the process of filtering/snoopin

Question

I'm looking into using mitm-proxy, but part of the process of filtering/snooping SSL is that you must generate and install a root cert as a trusted CA, so that mitm-proxy can generate and throw out fake certs on the fly. This seems like a potentially huge security hole to me though. I'm wondering what are the implications exactly, the risks and how can one go about mitigating them? To be more specific, couldn't a malicious application simply abuse this cert? If so, how can one prevent it?

Let me further clarify. Let's say I want to install the cert because I want to use mitm-proxy. But, now theres a cert that the entire system trusts as an authority. Could this not be abused by a malicious program?

Explanation / Answer

The certificate file by itself does not suppose a threat. When you load it into your browser it only lists it as a trusted source.

That means that any certificate signed by that issuer should be trusted and thus allow you to connect to a site.

Without access to the corredponding private key (which should be only present in the proxy), it cannot be used to sign a new certificate, just as any other trusted CA you have already in your browser, like VeriSign, GlobalSign, Thawte, etc.

Your custom CA should be strong enough to avoid being broken too easily (just use 2048bit and SHA-1 or higher), but as long as you keep your private key safe, it would be like any other CA in your system.

The only security concern that you should take seriously into account is what the proxy trusts, as all the systems that use that proxy would "share" its weaknesses.

If you configure the proxy itself to verify the certificates from third party sites and refuse to connect to sites with bad certs (expired, wrong name, unknown CA, and such), you should be safe.

Note: sites that ask for client certificates to authenticate will not work under this scenario, as the client certificate and its private key would reside on the client browser, so the proxy will not be able to use them. Use an exception list to such sites to allow the clients to connect without doing the mitm if in need.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.