Re: How prevalent is SSL inspection by way of certificate replacement on proxy's?

On 1/20/2015 8:42 PM, Scott Klement wrote:

For this reason, it's not necessary to have separate SSL
communication with the proxy itself (vs. the destination server) and
so there's no need for certificate "replacement".

In this situation the organization wants to be able to decrypt the SSL traffic ... so the proxy substitutes the certificate the target server uses with it's own.

This isn't something I'm trying to implement ... it already exists. If the customer goes to a SSL site, the CA is that shows up when you look at the SSL encryption information identifies the proxy as the CA instead of the actual site's CA.

Steve Gibson did a writeup on this ... https://www.grc.com/fingerprints.htm

I am trying to determine how prevalent this is and if I need to provide specific support for the situation (i.e., accepting an untrusted certificate).

david