0

I am trying to set up a local proxy for an SSL-based (HTTPS) service. The proxy will need access to the clear-text of the content going in both directions (for compliance reasons). I have control over the server certificate, as well as complete control over the proxy and its certificate.

I understand that this is effectively a man-in-the-middle attack and therefore exactly what SSL is supoosed to prevent, but I'm wondering if this sort of setup is possible to do with some certificate magic and local DNS redirection. If possible, I would like to configure the SSL certificates such that when connections go to service.something.com from the LAN, they go to the proxy, but when they originate in the rest of the internet they go directly to service.something.com.

Is this possible? If so how would I do it? Thanks.

EDIT: It seems that people may be downvoting this question because they think I am doing something shady. I am not. I am simply trying to enable a compliance department to do the monitoring necessary to satisfy legal requirements. I'm sorry if you still don't agree with this, but without it, the company would not be allowed to use the service.

1 Answer 1

-2

You could use fiddler2 (http://www.fiddler2.com/Fiddler/help/httpsdecryption.asp) and set the certificate as trusted within the LAN. But keep in mind that this method is not legal if you sniff out the encrypted web traffic without permission of users within the LAN.

5
  • "Not legal" depends widely on jurisdiction, employee contract, etc.
    – ceejayoz
    Jan 8, 2013 at 15:24
  • "Not legal[...] without permission."
    – patricks
    Jan 8, 2013 at 15:37
  • 1
    Still untrue in many jurisdictions around the world, including, to my knowledge, a lot of places in the United States.
    – ceejayoz
    Jan 8, 2013 at 16:04
  • 3
    If it wasn't clear above, this would be done with the approval of the compliance department at the owner of the LAN...
    – brooks94
    Jan 8, 2013 at 16:48
  • I don't think legal advice is a good fit for this question. We are a technical site, and it doesn't look like the submitter is doing anything particularly dangerous.
    – gparent
    Jan 8, 2013 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .