Lets Encrypt and SSL Man in the Middle Filtering
-
Hi
it is possible to use Lets Encrypt Certificates to make a transparent proxy with ssl filtering?
The CA of lets encrypt is integrated into browser, so I would be not necessery to import the CA/Certificate on a client
Greetz
-
No, that's absolutely NOT how it works. LE will never ever provide you with a * certificate. Squid creates a new certificate on-the-fly for each site, using the internal CA you need to install and trust on any client.
-
The Let's Encrypt CA on your system does NOT include the key, it is only the certificate. You can't make your own certificates without the key.
Let's Encrypt automatically signs requests only if your request can pass validation. Since you don't control the domains or sites in question, you could never pass the validation and thus could never obtain a certificate from Let's Encrypt for those sites.
The only way you can do MITM is with your own self-signed CA installed on every device/browser. Period.
-
The Let's Encrypt CA on your system does NOT include the key, it is only the certificate. You can't make your own certificates without the key.
Let's Encrypt automatically signs requests only if your request can pass validation. Since you don't control the domains or sites in question, you could never pass the validation and thus could never obtain a certificate from Let's Encrypt for those sites.
The only way you can do MITM is with your own self-signed CA installed on every device/browser. Period.
What kind of certificate should I buy to make Man in the Middle to filter https? And some place that you recommend me to compare?
-
You cannot buy one. Nobody is going to make you a globally trusted CA so you can do MITM, you could impersonate any server on the Internet and break the entire purpose of SSL.
There are places that will sell you a local/untrusted CA but it offers zero advantage over self-signing, you pay for nothing, because you still have to load the CA on clients.
Make your own CA, install the CA on client devices/browsers. There is no way around that for MITM.
-
The Let's Encrypt CA on your system does NOT include the key, it is only the certificate. You can't make your own certificates without the key.
Let's Encrypt automatically signs requests only if your request can pass validation. Since you don't control the domains or sites in question, you could never pass the validation and thus could never obtain a certificate from Let's Encrypt for those sites.
The only way you can do MITM is with your own self-signed CA installed on every device/browser. Period.
What kind of certificate should I buy to make Man in the Middle to filter https? And some place that you recommend me to compare?
The USA government cannot even do this. You make your own and manually install them on your local machines.
