<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/26/2012 04:15 PM, Craig Askings
wrote:<br>
</div>
<blockquote cite="mid:508A2A86.8030808@askings.com.au" type="cite">
<meta http-equiv="Context-Type" content="text/html;
charset=ISO-8859-1">
<div class="moz-cite-prefix">On 26/10/2012 4:05 PM, Paul Gear
wrote:<br>
</div>
<blockquote cite="mid:508A282C.80802@libertysys.com.au"
type="cite">
<div class="moz-cite-prefix">I would really love to know how
these UTM devices think they can do this securely, given the
appalling level of proxy support in Mac, iOS, and Android
apps. Or is their certificate validation so poor that they
just don't care that they're being MitM-ed?<br>
<br>
Paul<br>
</div>
</blockquote>
<br>
The normal trick for SSL is to make a new root ca + wildcard cert
and forcibly install the root ca onto each PC via A/D or MDM for
the iOS and Android devices. From there you just MitM with the
wildcart cert installed on the UTM.<br>
</blockquote>
<br>
<div class="moz-cite-prefix">On 10/27/2012 06:43 AM, Scott Howard
wrote:<br>
</div>
<blockquote
cite="mid:CACnPsNX=ikbwW23s7MN_J46io=YBhBvbdS_88vQKnwcXVHA3nw@mail.gmail.com"
type="cite"><br>
They do involve a new root CA as you've mentioned, but not a
wildcard cert. Instead, they create dynamic certs for the sites
being accessed, and then sign them with the root CA which the
end-user trusts.<br>
...<br>
The problem here is getting the cert in the users browser. In a
controlled corporate environment this is relatively easy (standard
build, MS GPO, etc). In an uncontrolled environment, it's pretty
much impossible.</blockquote>
<br>
So what do you do for the scenario where you're providing service
for BYOD or public networks (as the OP seemed to be) and have no
authority to touch the end user's device? When we tried this, we
came to the conclusion that we would have to allow unfettered
outbound HTTPS if we weren't to have massive user experience rage,
and this basically eliminates the benefit of any filtering.<br>
<br>
I usually intercept all outbound DNS and SMTP (and NTP, but that's
just for efficiency) and force it through the local server so that
we can at least force use of OpenDNS and virus/spam check outgoing
mail. But that's not much of a mitigation...<br>
<br>
Paul<br>
<br>
P.S. I would have thought that creating dynamic certificates on the
fly would be too processor intensive for all but the smallest
sites...<br>
</body>
</html>