1

I am looking into how SSL inspection works. I have some general ideas how it works but I could not figure out a couple of issues.

When SSL inspection is used on client accessing some non-mainstream sites (Let's say https://neverheardof.net). Wouldn't the SSL inspector needs to sign a certificate on the fly? What if the attacker is the client and it generates a bunch of requests to rarely used sites? Would that bring down the SSL inspector?

On the other hand, if the visiting site uses a in-secured certificate, either expired, invalid or self-signed, what could the SSL inspector do? If it signs the certificate, it will mask security problem. If it rejects the certificate, it will deny the client access. If it passes through the cert, will it still be able to inspect?

3

Wouldn't the SSL inspector needs to sign a certificate on the fly?

Yes, this is the way it works. It will have its own CA trusted by the clients and then use this CA to issue new certificates on the fly.

What if the attacker is the client and it generates a bunch of requests to rarely used sites? Would that bring down the SSL inspector?

If the SSL inspector has a performance problem the access through the site usually just gets slower.

... if the visiting site uses a in-secured certificate, either expired, invalid or self-signed, what could the SSL inspector do? If it signs the certificate, it will mask security problem. If it rejects the certificate, it will deny the client access. If it passes through the cert, will it still be able to inspect?

Some will simply deny access. Some will ignore the problem and create a valid certificate, thus masking the problem. Some will replace the invalid certificate with a different invalid certificate, thus making inspection possible but also forwarding the problem. How it behaves depends on implementation and sometimes configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.