Versions Compared

Old Version 4

changes.mady.by.user user-9a25e

Saved on

compared with

New Version 5

changes.mady.by.user user-9a25e

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Given the ease of availability of the Untangle NG Firewall, I used their SSL Inspector as an example. By default the Untangle SSL Inspector did not inspect traffic to https://badssl.com. As a result, I modified the default configuration of the SSL Inspector to inspect all HTTPS traffic. The other product tested is the Entensys UserGate UTM product, which also provides SSL inspection capabilities. Note that by default UserGate does not select the "Block sites with invalid certificates" option, meaning that the client is allowed to connect to sites with invalid certificates.

The client platform used for the test was Windows 7 with both Firefox 54.0.1 and Chrome 60.

...

badssl.com Test
Firefox 54.0.1 (Windows)
Chrome 60 (Windows)
Untangle SSL Inspected

UserGate Web Filter
(Default config)

UserGate Web Filter
(Block sites with invalid certificate)

Certificate




expiredSEC_ERROR_EXPIRED_CERTIFICATENET::ERR_CERT_DATE_INVALIDResetAllowed"Incorrect SSL certificate"
wrong.hostSSL_ERROR_BAD_CERT_DOMAINNET::ERR_CERT_COMMON_NAME_INVALIDBlockedBlockedCertificate validation left up to client
self-signedSEC_ERROR_UNKNOWN_ISSUER

NET::ERR_CERT_AUTHORITY_INVALID

ResetAllowed"Incorrect SSL certificate"
untrusted-rootSEC_ERROR_UNKNOWN_ISSUERNET::ERR_CERT_AUTHORITY_INVALIDResetAllowed"Incorrect SSL certificate"
revokedSEC_ERROR_REVOKED_CERTIFICATENET::ERR_CERT_REVOKEDAllowedAllowedAllowed
pinning-testMOZILLA_PKIX_ERROR_KEY_PINNING_FAILURENET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAINAllowedAllowedAllowed
no-common-nameAllowedAllowedAllowedAllowedAllowed
no-subjectAllowedAllowedResetResetReset
incomplete-chainAllowedAllowedResetAllowed"Incorrect SSL certificate"
sha1-intermediateSEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLEDAllowedAllowedAllowedAllowed
sha256AllowedAllowedAllowedAllowedAllowed
sha384AllowedAllowedAllowedAllowedAllowed
sha512AllowedAllowedAllowedAllowedAllowed

1000-sans

AllowedAllowedAllowedAllowedAllowed
10000-sansSSL_ERROR_RX_MALFORMED_HANDSHAKEERR_SSL_PROTOCOL_ERRORCertificate validation left up to clientBlockedBlockedBlocked

ecc256

AllowedAllowedecc256AllowedAllowedAllowed
ecc384AllowedAllowedAllowedAllowedAllowed
rsa2048AllowedAllowedAllowedAllowedAllowed
rsa8192AllowedAllowedAllowedAllowedAllowed
Cipher Suite




cbcAllowedAllowedAllowedAllowedAllowed
rc4-md5SSL_ERROR_NO_CYPHER_OVERLAPERR_SSL_VERSION_OR_CIPHER_MISMATCHResetBlockedBlocked
rc4SSL_ERROR_NO_CYPHER_OVERLAPERR_SSL_VERSION_OR_CIPHER_MISMATCHResetBlockedBlocked
3desAllowedAllowedAllowedAllowedAllowed
nullSSL_ERROR_NO_CYPHER_OVERLAPERR_SSL_VERSION_OR_CIPHER_MISMATCHResetBlockedBlocked
mozilla-oldAllowedAllowedAllowedAllowed
mozilla-intermediateAllowedAllowedAllowedAllowed
mozilla-modernAllowedAllowedAllowedAllowed
Key exchange




dh480SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEYERR_SSL_VERSION_OR_CIPHER_MISMATCHResetAllowedAllowed
dh512SSL_ERROR_WEAK_SERVER_EPHEMERAL_DH_KEYERR_SSL_VERSION_OR_CIPHER_MISMATCHResetAllowedAllowed
dh1024AllowedERR_SSL_VERSION_OR_CIPHER_MISMATCHAllowedAllowedAllowed
dh2048AllowedERR_SSL_VERSION_OR_CIPHER_MISMATCHAllowedAllowedAllowed
dh-small-subgroupAllowedERR_SSL_VERSION_OR_CIPHER_MISMATCHAllowedAllowedAllowed
dh-compositeAllowedERR_SSL_VERSION_OR_CIPHER_MISMATCHResetAllowedAllowed
static-rsaAllowedAllowedAllowedAllowedAllowed
Certificate Transparency




invalid-expected-sctAllowedNET::ERR_CERTIFICATE_TRANSPARENCY_REQUIREDAllowedAllowedAllowed
Defunct




sha1-2016SEC_ERROR_EXPIRED_CERTIFICATE

NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM

ResetAllowed"Incorrect SSL certificate"
sha1-2017SEC_ERROR_EXPIRED_CERTIFICATENET::ERR_CERT_WEAK_SIGNATURE_ALGORITHMResetAllowed"Incorrect SSL certificate"

About the red "Allowed" items above

...

Here, the browser recommends that the user verify their internet connection and firewall, and run Windows Network Diagnostics. None of which will actually address the problem.

About the yellow "Incorrect SSL certificate" items above

When connecting via an Entensys UserGate proxy that has been explicitly configured to validate SSL certificates (the default is to allow invalid certificates), the user is presented with HTML content that indicates that the SSL certificate is "incorrect," without mentioning what the problem is. For example, Google Chrome connected via UserGate configured in such a manner:

Image Added

Conclusion

As first mentioned in the 2015 blog post The Risks of SSL Inspection, the ability to inspect HTTPS traffic does not come without its costs. Given the ease of testing the impact with the badssl.com website, this impact is now easier for users and network administrators to determine. The table above currently only contains results for the Untangle SSL Inspector product, however other similar products have similar results. HTTPS inspection is not something that can be done at the network level without negatively affecting the security of the clients.

...