Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am trying to set up a local proxy for an SSL-based (HTTPS) service. The proxy will need access to the clear-text of the content going in both directions (for compliance reasons). I have control over the server certificate, as well as complete control over the proxy and its certificate.

I understand that this is effectively a man-in-the-middle attack and therefore exactly what SSL is supoosed to prevent, but I'm wondering if this sort of setup is possible to do with some certificate magic and local DNS redirection. If possible, I would like to configure the SSL certificates such that when connections go to service.something.com from the LAN, they go to the proxy, but when they originate in the rest of the internet they go directly to service.something.com.

Is this possible? If so how would I do it? Thanks.

EDIT: It seems that people may be downvoting this question because they think I am doing something shady. I am not. I am simply trying to enable a compliance department to do the monitoring necessary to satisfy legal requirements. I'm sorry if you still don't agree with this, but without it, the company would not be allowed to use the service.

share|improve this question

1 Answer 1

You could use fiddler2 (http://www.fiddler2.com/Fiddler/help/httpsdecryption.asp) and set the certificate as trusted within the LAN. But keep in mind that this method is not legal if you sniff out the encrypted web traffic without permission of users within the LAN.

share|improve this answer
    
"Not legal" depends widely on jurisdiction, employee contract, etc. –  ceejayoz Jan 8 '13 at 15:24
    
"Not legal[...] without permission." –  patricks Jan 8 '13 at 15:37
1  
Still untrue in many jurisdictions around the world, including, to my knowledge, a lot of places in the United States. –  ceejayoz Jan 8 '13 at 16:04
3  
If it wasn't clear above, this would be done with the approval of the compliance department at the owner of the LAN... –  brooks94 Jan 8 '13 at 16:48
    
I don't think legal advice is a good fit for this question. We are a technical site, and it doesn't look like the submitter is doing anything particularly dangerous. –  gparent Jan 8 '13 at 16:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.