3 ms·
This is very cool and really needed, can't wait to try it out. One benefit of terminating SSL at the load balancer is that you can read the http traffic sent t
by jmartrican 4y ago
This is very cool and really needed, can't wait to try it out.
One benefit of terminating SSL at the load balancer is that you can read the http traffic sent to your pods. But for those that have SSL terminating at their pods, it would be cool if this tool could be given the SSL certificates of the pods so it can decipher https traffic.
- dilyevsky 4y agoJust private key is not enough bc of PFS - you need to intercept key exchange to grab a temporary session key
- benmmurphy 4y agoOne option is to use ebpf uprobes to dump the key material or plaintext (https://github.com/ehids/ecapture https://github.com/ehids/ecapture ). Should be easy for c-like TLS libraries probably less useful for JIT languages.
- jmartrican 4y agoSolid point. Didn't realize that.
- intelVISA 4y agoTLS termination before the destination? Oof, are you running Cloudflare?
- cassianoleal 4y agoCloud Load Balancers in general have limited feature sets or don't work at all without handling TLS termination. Terminating TLS on the LB doesn't preclude you from also using TLS or mTLS internally though.