4 ms·
My main complaint with attempts to MITM TLS is that it is a failure -- you cannot actually MITM TLS without breaking TLS. Specifically, TLS client certificates
by rkeene2 10y ago
My main complaint with attempts to MITM TLS is that it is a failure -- you cannot actually MITM TLS without breaking TLS. Specifically, TLS client certificates are almost always broken when by attempts to MITM TLS and we use TLS client certificates for almost all HTTPS connections.
- majewsky 10y agoThis was actually a huge problem when, at $work, we recently locked down our productive Kubernetes clusters to only allow access via an SSH jump server. The approach that we've settled on is to have a forward HTTP (without S) proxy on the jump server (listening only on localhost) whose port is forwarded to the local machine by SSH, so we can do `export https_proxy=https://localhost:$forwarded_port` https://localhost:$forwarded_port` to make kubectl work. sshuttle was also evaluated, but it clashes with the VPN client that the remote colleagues need.
- majewsky 10y agoCannot edit anymore, but that sould be "http://" http://" instead of "https://" https://".