6 ms·
Honest question (I know just enough about SSL to be dangerous): Does certificate pinning throw a wrench in this plan?
by notafraudster 6y ago
Honest question (I know just enough about SSL to be dangerous): Does certificate pinning throw a wrench in this plan?
- rntksi 6y agoIf proper revoking procedures are being followed, no. You can start reading more info here: https://developer.mozilla.org/en-US/docs/Web/Security/Certificate_Transparency https://developer.mozilla.org/en-US/docs/Web/Security/Certif... (HPKP is considered obsolete, if by cert pinning you meant that. If you're confusing HSTS with HPKP, just know that HSTS makes it much harder to mistakenly access the site via http, while HPKP [now deprecated] is the practice of ensuring some hashes is found in the cert that the server sends to mitigate some attacks)
- NovemberWhiskey 6y agoAt this point, I don't think certificate pinning in the general internet/web environment is a thing.
- LinuxBender 6y agoAgreed. I MITM all my own traffic and I only have to exclude a handful of domains or A records on domains to not MITM.
- leesalminen 6y agoHonestly curious, why do you MITM all your own traffic? For detailed logging?
- LinuxBender 6y agoLogging, ACL's for some mime types, overriding cache controls, shared cache for multiple devices, blocking some sites that I can't block using DNS.
- leesalminen 6y ago> shared cache for multiple devices Oh, that’s a neat one and would be very valuable for me. We have poor internet access at home and would be cool to reduce traffic going out to the net. Thanks for the reply, appreciate it!
- LinuxBender 6y agoNo problem. You can find examples of how to set up Squid-SSL-Bump or I can provide examples if you can't find any.
- Nextgrid 6y agoI thought about doing this on my own network (for caching purposes primarily) but I'm concerned about breaking the "end to end" guarantee of TLS. Essentially, now a separate box on the network has full access to my TLS traffic and if compromised can silently intercept it (and it would be too late by the time I notice). How do you deal with/rationalize this concern?
- LinuxBender 6y agoI control the box doing the decryption, so it is still my system. I can tell Squid which ciphers are appropriate and whether or not I want to validate the chain or accept anything. All of those controls still exist. But yes, I would be concerned as you are if I were using a proprietary proxy like Bluecoat or Websense.
- tialaramex 6y agoBefore choosing to use pinning you should have planned for this situation. Rather than write it out here, I'll link a post I wrote in a Let's Encrypt forum in response to someone who'd just blown up their system due to a different pinning mistake. https://community.letsencrypt.org/t/certificate-failure-due-to-x3-to-r3-intermediate-certification-transition/143614/22 https://community.letsencrypt.org/t/certificate-failure-due-...
- Wowfunhappy 6y agoPlease don't enforce certificate pinning in user-facing software, at least without an opt-out. It becomes impossible to inspect my own traffic.
- cheeze 6y agoIt also leads to a ton of clients who freak out when their app suddenly goes offline because they forgot to update the pinned cert. Seen that one countless times. Pinning has uses, but if I'm running an app, I'm not doing pinning unless I have to. Pinning to the issuing or root is much safer from an availability standpoint.