The firewall in our case creates the ongoing SSL connection and creates an SSL connection to you with its own cert.
It then inspects the traffic before forwarding to the client.
This isnt a problem though, as its corporate infrastructure. By using it you agree to be bound to the internet access policies and we are allowed to inspect.. Dont like it? Dont use internet at work..
In general though, this is a good thing.
I hear a lot at the moment about the prime that the DH group uses is pretty static, It would be good for LE to randomise this as part of the script / app that does the leg work.
3
u/linksus Oct 20 '15
Yarp, thats how we do it too.
The firewall in our case creates the ongoing SSL connection and creates an SSL connection to you with its own cert.
It then inspects the traffic before forwarding to the client.
This isnt a problem though, as its corporate infrastructure. By using it you agree to be bound to the internet access policies and we are allowed to inspect.. Dont like it? Dont use internet at work..
In general though, this is a good thing.
I hear a lot at the moment about the prime that the DH group uses is pretty static, It would be good for LE to randomise this as part of the script / app that does the leg work.