3 ms·

But how? Normally the TLS handshake and encryption/decryption happen in user space. Even the kernel doesn’t know anything about it.

by ruszki 2mo ago

icedchai 2mo ago
There is a transparent proxy installed (along with the necessary certificates on the VM.) For an example, see https://docs.microsandbox.dev/networking/tls https://docs.microsandbox.dev/networking/tls
- ruszki 2mo ago
  So, if the program or the proxy solution doesn’t support it, then it doesn’t work? Like with security solutions?
  - icedchai 2mo ago
    The docs mention it can be bypassed for configured domains.
    - ruszki 2mo ago
      Yes, I read it. That means that it doesn’t work in those cases. Btw, as a developer it’s very easy to have something like that. It’s not as trivial as it seems at all. I encountered with similar problems all the time, with similar solutions (mainly for security theater reasons) in the past. There are websites which simply doesn’t work if you replace certificates, regardless of browser or CA for example.
      - icedchai 2mo ago
        Yes, I've worked with people who have run into issues with "security" solutions like ZScaler. I have tried it with some APIs (like GitHub) and it does work. Not to say it will work in your case.
        ruszki 2mo ago
        I was just interested how it works, because above it was sold as “it works”, when in reality, “it works*”.
        icedchai 2mo ago
        Isn't it that way with most software? "It works", except when it doesn't.
        ruszki 2mo ago
        There is a difference between bugs/failures, and false advertisement. The solution used here has well known shortcomings.
        icedchai 2mo ago
        All SSL/TLS interception has the shortcoming. In other contexts, that’s a good thing, when certificate pinning works, I mean.
      - toksdotdev 2mo ago
        microsandbox is designed to work with most security products. there's a dedicated section for this in the docs that makes this entire process seamless: https://docs.microsandbox.dev/networking/tls#trusting-host-cas https://docs.microsandbox.dev/networking/tls#trusting-host-c...
  - deleted 2mo ago
    [deleted]
  - toksdotdev 2mo ago
    microsandbox maintainer here. the custom certificate is installed in the guest's trusted root CA list, so it should work across any program, except where the program opts to explicitly pin certificates for a destination.

But how? Normally the TLS handshake and encryption/decryption happen in user space. Even the kernel doesn’t know anything about it.

by ruszki 2mo ago

But how? Normally the TLS handshake and encryption/decryption happen in user space. Even the kernel doesn’t know anything about it.

icedchai 2mo ago

There is a transparent proxy installed (along with the necessary certificates on the VM.) For an example, see https://docs.microsandbox.dev/networking/tls https://docs.microsandbox.dev/networking/tls

ruszki 2mo ago
So, if the program or the proxy solution doesn’t support it, then it doesn’t work? Like with security solutions?
- icedchai 2mo ago
  The docs mention it can be bypassed for configured domains.
  - ruszki 2mo ago
    Yes, I read it. That means that it doesn’t work in those cases. Btw, as a developer it’s very easy to have something like that. It’s not as trivial as it seems at all. I encountered with similar problems all the time, with similar solutions (mainly for security theater reasons) in the past. There are websites which simply doesn’t work if you replace certificates, regardless of browser or CA for example.
    - icedchai 2mo ago
      Yes, I've worked with people who have run into issues with "security" solutions like ZScaler. I have tried it with some APIs (like GitHub) and it does work. Not to say it will work in your case.
      - ruszki 2mo ago
        I was just interested how it works, because above it was sold as “it works”, when in reality, “it works*”.
        icedchai 2mo ago
        Isn't it that way with most software? "It works", except when it doesn't.
        ruszki 2mo ago
        There is a difference between bugs/failures, and false advertisement. The solution used here has well known shortcomings.
        icedchai 2mo ago
        All SSL/TLS interception has the shortcoming. In other contexts, that’s a good thing, when certificate pinning works, I mean.
    - toksdotdev 2mo ago
      microsandbox is designed to work with most security products. there's a dedicated section for this in the docs that makes this entire process seamless: https://docs.microsandbox.dev/networking/tls#trusting-host-cas https://docs.microsandbox.dev/networking/tls#trusting-host-c...
- deleted 2mo ago
  [deleted]
- toksdotdev 2mo ago
  microsandbox maintainer here. the custom certificate is installed in the guest's trusted root CA list, so it should work across any program, except where the program opts to explicitly pin certificates for a destination.