4 ms·

SSL certificates have to be signed by a vendor ( authority ) your browser trusts or the certificates are considered invalid ( hence the hoo-ha when firefox or c

by knome 8y ago

SSL certificates have to be signed by a vendor ( authority ) your browser trusts or the certificates are considered invalid ( hence the hoo-ha when firefox or chrome occasionally stop trusting some vendor for bad practices ). Your workplace can install themselves as a trusted certificate authority on client machines in order to break that model and allow themselves to issue certificates on the fly for any website. If you're using your own hardware, they can't do this to you. If you're using someone else's, you're at their mercy.

bawana 8y ago
then i totally misunderstood how squid bypasses ssl. My understanding is that: After building a TCP connection, the SSL handshake is started by the client and sends which version of TLS it knows. The server then picks a compatible cipher and compression method. and then sends its certificate. This certificate must be trusted by either the client itself or a party that the client trusts(a certificate authority). In this context the word 'trust' means that the client has the public key that can decrypt the certificate. For example, if the client trusts GeoTrust, then the client can trust the certificate from Google.com because GeoTrust used its private key to cryptographically sign Google's certificate and my browser has the public key for Geotrust. How SQUID enables SSL failure is obscure to me because the failure of SSL is complicated and this slide is overwhelming https://blog.ivanristic.com/SSL_Threat_Model.png https://blog.ivanristic.com/SSL_Threat_Model.png SQUID is a proxy for the website you want to access - so when your browser negotiates the TLS handshake it's really talking to SQUID who then talks to the website if necessary. So how does your browser get directed to an illegitimate proxy? The only way I can imagine is if the DNS is bad but I don't see how that can happen. So for example you want to go to google.com Your browser goes out to your DNS (the ip you plugged in to the network configuration settings) and gets the ip for google. How can someone interpose squid between you and google ? And then even if squid talks to the server on your behalf, it cannot just forward that stuff to you in clear text because you are expecting that stuff to be encrypted with a private key that only the server or the certificate authority has. Since squid doesn't have the private key it needs, I don't understand what it does. This wiki https://wiki.squid-cache.org/Features/SslBump https://wiki.squid-cache.org/Features/SslBump says "Squid-in-the-middle decryption and encryption of straight CONNECT and transparently redirected SSL traffic, using configurable CA certificates." I interpret that to mean that squid configures a CA certificate. So squid can make it appear like you are talking directly to google?

by knome 8y ago

bawana 8y ago

then i totally misunderstood how squid bypasses ssl. My understanding is that: After building a TCP connection, the SSL handshake is started by the client and sends which version of TLS it knows. The server then picks a compatible cipher and compression method. and then sends its certificate. This certificate must be trusted by either the client itself or a party that the client trusts(a certificate authority). In this context the word 'trust' means that the client has the public key that can decrypt the certificate. For example, if the client trusts GeoTrust, then the client can trust the certificate from Google.com because GeoTrust used its private key to cryptographically sign Google's certificate and my browser has the public key for Geotrust. How SQUID enables SSL failure is obscure to me because the failure of SSL is complicated and this slide is overwhelming https://blog.ivanristic.com/SSL_Threat_Model.png https://blog.ivanristic.com/SSL_Threat_Model.png SQUID is a proxy for the website you want to access - so when your browser negotiates the TLS handshake it's really talking to SQUID who then talks to the website if necessary. So how does your browser get directed to an illegitimate proxy? The only way I can imagine is if the DNS is bad but I don't see how that can happen. So for example you want to go to google.com Your browser goes out to your DNS (the ip you plugged in to the network configuration settings) and gets the ip for google. How can someone interpose squid between you and google ? And then even if squid talks to the server on your behalf, it cannot just forward that stuff to you in clear text because you are expecting that stuff to be encrypted with a private key that only the server or the certificate authority has. Since squid doesn't have the private key it needs, I don't understand what it does. This wiki https://wiki.squid-cache.org/Features/SslBump https://wiki.squid-cache.org/Features/SslBump says "Squid-in-the-middle decryption and encryption of straight CONNECT and transparently redirected SSL traffic, using configurable CA certificates." I interpret that to mean that squid configures a CA certificate. So squid can make it appear like you are talking directly to google?