I would like to set up a transparent SSL corporate proxy with either privoxy or squid.
One of the snags in my plan is understanding what kind of SSL certificate is required. I know I can get a multi-domain / wildcard SSL certificate; however, that is only intended to cover sub-domains for a single organization. It would seem that I need a wildcard cert for every TLD now and future on the planet.
I do not want security warnings popping up when users go through the proxy due to security-checks failing; I would also like to avoid installing a manual CA trust in browsers if possible. However, if commercial solutions are not feasible, what solutions are available for a self-signed cert?
There are two approaches to MITMing SSL traffic:
The former is easier to do, but the latter is better if you don't want it to be obvious of what you're doing, because the certificate will look more "legitimate" to the casual observer.
The real trick is getting one of these super-special certificates. The easier way for a legitimate organisational proxy is to generate your own certificate signed with your own CA, and distribute that CA certificate to every device within your organisational control. The challenges and limitations of this approach should be fairly obvious.
A dodgier way of doing things is only typically open to governments and organisations big enough to subvert a CA (one way or another...) -- in this case, you get an existing legitimate CA, whose CA certificate is already near-universally trusted, to give you one of the above dodgy certs, and you go on your merry way.
This latter method isn't theory -- there are numerous cases of governments of oppressive regimes getting hold of these sorts of certificate to subvert SSL connections within their borders and spy on traffic passing through their chokepoints. If this makes it sound like the SSL security model is completely broken and flawed, then you've got the right idea.
I'm looking for a tool to analyze the traffic between two proprietary apps. It's https and I can control the certs and proxy.
I can't seem to be able to find a free/open source tool to do that, so before I roll my own, any recommendations?
Edit: the few I've seen do not look maintained anymore (Parros?)
Easiest option would be to terminate the SSL in front of the webserver (rather than on it) and sniff the traffic between the termination and the webserver. Stunnel is ideal for this.
Well MitmProxy appears to be fitting the bill!