From: Jake Cutter <cutter38@...>
Date: 2007-01-29T11:42:59+09:00
Subject: Re: SSL man in the middle in Ruby?

------=_Part_26227_2310390.1170038576157
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

On 1/28/07, Jeff Barczewski <jeff.barczewski@gmail.com> wrote:
>
> Yes you are correct, nginx will work as a reverse proxy not a proxy. So
> you
> are wanting more like a regular proxy to be able to monitor traffic to
> external sites. However, other than knowing the IP address they are trying
> to go to, note that SSL will not allow you to decrypt the traffic in the
> middle, this is by design (to prevent the man in the middle attack). The
> key
> negotiation is between the client and the final destination. So you won't
> be
> able to know anything other than the IP address that the client is
> connecting to and maybe a rough idea of traffic volume, you won't have any
> specifics about the what kind of data or exact site name.


Jeff,

I do note this. However, the plan is to offer our own certificate for
*every* connection from the client, and then have the proxy engine itself
create the SSL connection to the server on the backend. delegate (
www.delegate.org) and WebScarab operate in this fashion, and are able to
decrypt all traffic that way.

Thanks,
John

------=_Part_26227_2310390.1170038576157--