MiTM proxy having client authentication support
Methods, systems and computer readable media for a MiTM proxy that supports client authentication are described.
1. A method comprising:
receiving, at a man-in-the-middle (MiTM) proxy, a first client certificate request from a server during a communication session that utilizes a communication protocol;
recognizing the first client certificate request by the MiTM proxy;
transmitting, after receiving the first client certificate request from the server, from the MiTM proxy, a second client certificate request to a client;
receiving, at the MiTM proxy, a first set of response messages generated by the client in response to the second client certificate request;
obtaining, by the MiTM proxy a public certificate and a signed message, wherein the public certificate is mapped to the client and wherein the signed message is signed with a private key associated with the client;
generating, at the MiTM proxy, a second set of response messages configured to be sent to the server on behalf of the client in response to the first client certificate request message, the second set of response messages containing the public certificate and the signed message, the public certificate being managed by a third party system; and
sending, from the MiTM proxy to the server, the second set of response messages configured to authenticate the client to the server through the MiTM proxy.
2. The method of claim 1 , wherein the communication protocol includes a secure socket layer/transport layer security (SSL/TLS) protocol.
3. The method of claim 1 , wherein the third party system includes a hardware security module (HSM), and wherein the method further comprises obtaining the public certificate and the private key from the HSM.
4. The method of claim 1 , wherein the third party system includes a lightweight directory access protocol (LDAP) system, and wherein the method further comprises obtaining the public certificate and the private key from the LDAP system.
5. The method of claim 1 , wherein the third party system includes a Windows Active Directory system, and wherein the method further comprises obtaining the public certificate and the private key from the Windows Active Directory system.
6. The method of claim 1 , wherein the third party system includes a database, and wherein the method further comprises obtaining the public certificate and the private key from the database.
7. The method of claim 1 , further comprising:
requesting the public certificate mapped to the client from a hardware security module (HSM);
adding the public certificate received from the HSM to the second set of response messages;
requesting a hardware security module (HSM) to sign a certificate verify message for the MiTM proxy; and
sending the second set of response messages, including the certificate verify message signed by the HSM using the private key, to the server.
8. A system comprising:
a network communication interface;
one or more processors coupled to the network communication interface, the processors configured to perform operations comprising:
receiving, at a man-in-the-middle (MiTM) proxy, a first client certificate request from a server during a communication session in a communication protocol via the network communication interface;
intercepting, at the MiTM proxy, the first client certificate request;
forwarding, from the MiTM proxy, after receiving the first client certificate request from the server, a second client certificate request to a client;
intercepting, at the MiTM proxy, a first set of response messages generated by the client in response to the second client certificate request;
obtaining, by the MiTM proxy from a third party system, a public certificate mapped to the client and a private key associated with the client;
generating, at the MiTM proxy, a second set of response messages configured to be sent to the server on behalf of the client in response to the first client certificate request message, the second set of response messages containing the public certificate mapped to the client that was obtained by the MiTM proxy, and a certificate verify message generated by the MiTM proxy and signed using the private key associated with the client; and
sending, from the MiTM proxy to the server, the second set of response messages configured to authenticate the client to the server through the MiTM proxy.
9. The system of claim 8 , wherein the communication protocol includes a secure socket layer/transport layer security (SSL/TLS) protocol.
10. The system of claim 8 , wherein the third party system includes a hardware security module (HSM), and wherein the operations further include obtaining the public certificate and the private key from the HSM.
11. The system of claim 8 , wherein the third party system includes a lightweight directory access protocol (LDAP) system, and wherein the operations further include obtaining the public certificate and the private key from the LDAP system.
12. The system of claim 8 , wherein the third party system includes a Windows Active Directory system, and wherein the operations further include obtaining the public certificate and the private key from the Windows Active Directory system.
13. The system of claim 8 , wherein the third party system includes a database, and wherein the operations further include obtaining the public certificate and the private key from the database.
14. The system of claim 8 , wherein the operations further include:
requesting the public certificate mapped to the client from a hardware security module (HSM);
adding the public certificate received from the HSM to the second set of response messages;
requesting a hardware security module (HSM) to provide a private key associated with the client to sign the certificate verify message by the MiTM proxy; and
sending the second set of response messages, including the signed certificate verify message, to the server.
15. A nontransitory computer readable medium having stored thereon software instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:
receiving, at a man-in-the-middle (MiTM) proxy, a first client certificate request from a server during a communication session in a communication protocol;
intercepting, at the MiTM proxy, the first client certificate request;
forwarding, from the MiTM proxy, after receiving the first client certificate request from the server, a second client certificate request to a client;
intercepting, at the MiTM proxy, a first set of response messages generated by the client in response to the second client certificate request;
requesting, by the MiTM proxy to a third party system, a public certificate and a signed message, wherein the public certificate is mapped to the client and wherein the signed message is signed with a private key associated with the client;
obtaining, by the MiTM proxy from the third party system, the public certificate and the signed message;
generating, at the MiTM proxy, a second set of response messages configured to be sent to the server on behalf of the client in response to the first client certificate request message, the second set of response messages containing the public certificate mapped to the client that was obtained by the MiTM proxy and the signed message; and
sending, from the MiTM proxy to the server, the second set of response messages configured to authenticate the client to the server through the MiTM proxy.
16. The nontransitory computer readable medium of claim 15 , wherein the communication protocol includes a secure socket layer/transport layer security (SSL/TLS) protocol.
17. The nontransitory computer readable medium of claim 15 , wherein the third party system includes a hardware security module (HSM), and wherein the operations further include obtaining the public certificate and the signed message from the HSM.
18. The nontransitory computer readable medium of claim 15 , wherein the third party system includes a lightweight directory access protocol (LDAP) system, and wherein the operations further include obtaining the public certificate and the signed message from the LDAP system.
19. The nontransitory computer readable medium of claim 15 , wherein the third party system includes a Windows Active Directory system, and wherein the operations further include obtaining the public certificate and the signed message from the Windows Active Directory system.
20. The nontransitory computer readable medium of claim 15 , wherein the operations further include:
requesting the public certificate mapped to the client from a hardware security module (HSM);
adding the public certificate received from the HSM to the second set of response messages;
requesting a hardware security module (HSM) to sign a certificate verify message for the MiTM proxy; and
sending the second set of response messages, including the certificate verify message signed by the HSM, to the server.