Using dynamic generated certificates with Nginx

http://blog.dutchcoders.io/openresty-with-dynamic-generated-certificates/

by nl5887 • 11 years ago

27 10 11 years ago

blog.dutchcoders.io

cwmma• 11 years ago

so ... how to MITM an TLS connection?

jvehent• 11 years ago

If you can a) route the traffic through your proxy and b) generate a valid certificate for the target site that's accepted by web browsers, then yes, it's a mitm :)

wwwhizz• 11 years ago

Whilst a) is possible under some circumstances, b) should be impossible.

nileshtrivedi• 11 years ago

In case of (a), you can use MITMProxy[1] - a handy tool especially for debugging traffic from mobile devices.

1: https://mitmproxy.org/

vtlynch• 11 years ago

This is basically what existing corporate proxies (like FireEye) and AV software (like Avast!) already do.

nl58872• 11 years ago

Exactly, but now it is integrated in nginx. So this could be an alternative for proprietary software, or Squid.

feld• 11 years ago

What are the filtering capabilities? Someone needs to finish flushing this out (maybe make it speak to snort or something) because there are a lot of corporate proxies out there that don't support TLS 1.2, for example, which is a travesty that they're really downgrading your security.

nl58872• 11 years ago

Check out this library: https://github.com/dutchcoders/honos. It adds filtering on host, uri and content type to each request.

Using dynamic generated certificates with Nginx

Related Stories