Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Browsers show you an ugly red screen if you try to access a https website whose certificate is fake.

But why don't thes warn when you try to access a https site, like GMail, through the corporation's proxy?

If I understand proxies well, the computer asks them to load secure websites and tell the results, so the proxy will generate the https requests. Althrough the request between the proxy and web is secure, the sysadmin can still intercept your passwords and the content you viewing, isn't he?

Isn't this a security corcern?

(On many forums I saw many people think proxy = NAT, so I was unable to get my answer. :( )

share|improve this question

closed as not constructive by random Oct 13 '11 at 13:51

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers 3

Normal HTTPS proxies don't have access to the cryptographic keys or plaintext and so there is no security implication for the end user to be warned of.

In order to support HTTPS, proxies implement a special HTTP method: CONNECT, documented in RFC 2817. On receipt of a CONNECT request, the proxy opens a TCP connection to a specified remote server and then simply passes data between the client browser and the remote server without modifying it. The client browser simply transmits its TLS data to the proxy for onward transmission to the remote server. While the proxy has access to all the data, it only sees the encrypted data stream and can do nothing with it. While this is a good thing from a security point of view it also means that none of the data can be cached.

From Cambridge

A dozen years ago, I used to administer a HTTP/HTTPS proxy for a very large multinational corporation. The above was certainly true then.

share|improve this answer

It's relatively normal (in recent times) for corporate proxies to also intercept https trafic.

The reason the browser doesn't complain is because you are using the company PC, which will have installed an extra CA.

This extra CA will sign the https certificates the proxy returns, so your browser doesn't complain (they are valid certificates, as far as he knows).

If you check the certificate, you will probably see that any site you access via https is signed by the same CA.

And yes, everything you do with this type of proxies will be visible to the system admins (including passwords, etc), if they actually care.

Depending on the permissions you have on the machine, you could remove this company CA from the list of accepted CAs in the browser. Or use a live CD.

share|improve this answer
I assumed you knew the corporate proxy was also intercepting https, but you didn't say that, so my answer may be wrong. It's true there is no problem in having proxies and secure https connections, but it's also true that in a corporate environment, because the machine you are using may have corporate CAs installed, they can intercept your https traffic, and you only know for sure by examining the sites certificates you receive (and/or using an add-on like "Certificate Patrol" for firefox). –  nlucas Oct 13 '11 at 13:44

When you connect to a encrypted website your browser initiates a secure conection using the certificate of the website, and double checks if the certificate offered by the website matches the url of the website.

So for a proxy in between to be able to intercept/read what you are doing on a encrypted website it has to offer another certificate (which matches the domain of the original website) and make your browser believe everything is all right. This actually happened recently.

tl;dr A proxy will only see that you are using a encrypted website not the http requests passwords specific urls you are using.

share|improve this answer
So if they don't own a certificate, the browser will reject to connect to the https website? –  Calmarius Oct 13 '11 at 11:50
You can always generate a "self signed" certificate to encrypt the connections between server and client but the browser will warn you that it can't verify the identity of the website. –  seqastian Oct 20 '11 at 13:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.