How do proxy servers filter https websites?

Question

With my limited knowledge of HTTPS I started wondering: How do proxy servers filter HTTPS websites? I mean adding a proxy server is essentially a MITM attack which is what HTTPS was explicitly supposed to prevent

The only way I can think of is to block the server by IP and port. However with things like SNI and wildcard certificates this means that you could block legitimate content (assume that a site that must be blocked shares an IP with a site that must be available in this situation).

What does it do then? You can't read the content of the connection since its encrypted; all you know is that someone is most likely sending an HTTPS request to some IP address.

Answer 1

How do proxy servers filter HTTPS websites?

It isn't very easy. You have a couple poor choices, each with there own problems.

You can do it purely on the NAME/IP passed via the HTTP CONNECT request. Meaning you are likely to have lots of false positives/negatives.

You can perform a MITM attact. With a couple products in a corporate environment, a CA is setup, and must be trusted by the clients, and the proxy server creates certificates as needed so the client believes everything is fine. The proxy must validate the certificates of the sites the user connects to. This will also mean that if a site doesn't have a valid SSL cert, then it would probably be completely impossible for a client to continue to the site. I suspect you would also have a larger chance of legal issues if you did this.

There is also the possibility of running a filter on the client machine, but unless the client machine is really locked down, this probably wouldn't work to well.

However with things like SNI and wildcard certificates this means that you could block legitimate content

If you really need to filter SSL, you almost certainly need to do it as a whitelist, and not a blacklist. So you permit sites you trust, and block bad sites.

Answer 2

The browser knows it's connecting to a proxy, it's not really "fooled". There are passive proxies that you can setup, but still the browser will know that proxy is there the first time it hits an encrypted URL if the proxy doesn't just route the traffic through untouched. Often the connection to the proxy server is either always encrypted or always unencrypted, whichever the proxy and browser are configured for.

If you mean reverse proxy, where the proxy acts as the target server and proxies (usually for performance, failover, or load balancing features) to a backend server; the proxy has to be specially configured with the SSL information to be able to fool the browser. This information will be specific for the destination, it can't just impersonate any destination server. With these as well, the connection between the backend server and proxy, and the connection between the browser and client might each be encrypted, but not necessarily, and they aren't necessarily dependent on the other (though some proxies can be configured to be so).

In either case the proxy has to be configured either by your network, or the destination network. The proxy will be aware of the content being passed through, but there is no third party involved, just extensions to the original two parties.