Can proxy change SSL certificate? [closed]

问题:

Closed. This question is off-topic. It is not currently accepting answers.

---

Want to improve this question? Update the question so it's on-topic for Stack Overflow.

Closed 9 years ago.

I noticed an intersting thing. Every time when I access a SSL enabled website like chase.com in my company. The SSL certificate is not from a well known CA like VeriSign but the IT department of my company. We use a dynamic proxy (I don't know how to explain but we don't need to set it up in IE->connection section for sure) for every internet access. I was guessing that the proxy changes the SSL certificate to our IT's own certificate. My guess: Every time a SSL connection start, the proxy take my HTTPS request, get the certificate (let's call it SSL_Chase, for both SSL and the symetric key for data encryption) from the website like chase, change the certificate to our own IT certificate (let's call it SSL_IT) and send it with the respose to me. I fill out the user name and passowrd, my machine using SSL_IT to encrype my data and our proxy get it and unencrype it. Then the proxy encrype it using SSL_Chase and send to chase. So chase think our proxy is me and I think our proxy is chase, except the IT certificate is not from chase (I think most users won't notice it). This means, IT department knows everything we send to chase and chase send to me!! I was wondering if my guess is possible, from the SSL connection algorithm point of view. Hope anybody can give me a hint.

Thanks a lot!

回答1:

It probably goes like this: you have your IT department's certificate as a trusted root certificate on your computer. When you browse to an HTTPS address, the proxy generates a certificate for that site on the fly, signed by the certificate that's trusted on your site. You then communicate with your proxy, and the proxy communicates with the real site. Both "legs" of the travel are over SSL/TLS, so you're safe from a random man in the middle, but your IT department can theoretically view all the communication.

回答2:

This is a classical "man in the middle" approach, from a proxy's perspective. It's your browser's responsibility to warn you that the certificate presented doesn't match the site you are visiting. If you are using IE, your IT department most likely pushed the corresponding CA to you as trusted CA, so your browser trusts it automatically. For other browsers, not using Windows Cert Store, it's also possible, but a bit harder to do. In any way, an unsuspecting user can be led to believe that the information is transmitted in a direct SSL link to Chase, when it's not. In either case, you should still get a browser warning, if the proxy has the corresponding feature for the CONNECT verb.

回答3:

Yes, a proxy can act like a Man in the Middle.