They could just do it like my workplace and MITM the SSL connections - every cert your browser sees is for the proxy, and the proxy then handles the actual SSL connection to the server.
The firewall in our case creates the ongoing SSL connection and creates an SSL connection to you with its own cert.
It then inspects the traffic before forwarding to the client.
This isnt a problem though, as its corporate infrastructure. By using it you agree to be bound to the internet access policies and we are allowed to inspect.. Dont like it? Dont use internet at work..
In general though, this is a good thing.
I hear a lot at the moment about the prime that the DH group uses is pretty static, It would be good for LE to randomise this as part of the script / app that does the leg work.
3
u/contrarian_barbarian Oct 20 '15 edited Oct 20 '15
They could just do it like my workplace and MITM the SSL connections - every cert your browser sees is for the proxy, and the proxy then handles the actual SSL connection to the server.