3 ms·

mitm is the only way to secure egress with tls 1.3 native forward secrecy. root ca trusted cert on each device. ingress is tls offloading at waf

• TrumpRapedWomen 4y ago
• xvector 4y ago
  If your WAF is terminating TLS, can't it also initiate outgoing TLS connections? In this case the ephemeral Diffie-Hellman secrets would be created on the WAF, so it would have full ability to inspect traffic.
  • slt2021 4y ago
    it won't work for devices/website that do certificate pinning, device won't accept MitM'd certificates, only original non-intercepted certs are accepted https://www.thesslstore.com/blog/an-introduction-to-pinning/ https://www.thesslstore.com/blog/an-introduction-to-pinning/
    • xvector 4y ago
      Right, you pin the cert deployed on your WAF and you should still be able to terminate TLS at it. I see no issues here - your WAF itself is initiating and terminating outgoing and incoming TLS connections. DHE keys are generated on the WAF. The WAF's cert could be the authoritative one. The WAF could then re-establish a new connection to applications behind it. There does not seem to be any technical boundary here.
      • slt2021 4y ago
        there are embedded/IoT devices that pin ssl themselves and do not allow you to change that
        • DrMemeulous 4y ago
          Just don't use devices you can't configure?