Systems and methods for improving security of secure socket layer (SSL) communications
The disclosure is directed to a system for improving security of SSL communications. The system can include an device intermediary between one or more servers, one or more clients, a plurality of agents, and a web service. The servers can be configured to receive SSL connections and issue SSL certificates. The device can include a virtual server associated with a respective one of the servers, such that the SSL certificate of the respective server is transmitted through the device. The device can generate service fingerprints for the one or more servers. Each service fingerprint can include information corresponding to an SSL certificate of the virtual server, one or more DNS aliases for a virtual IP address of the respective virtual server, one or more port numbers serving the SSL certificate, and an IP address serviced by the device. The device also can transmit the service fingerprints to a web service.
1. A method for improving security of secure socket layer (SSL) communication, the method comprising:
determining, by a device intermediary to a plurality of clients and one or more servers, a configuration change associated with a virtual server executing on the device, the virtual server configured as a named entity of the device that at least one client of the plurality of clients uses to access applications hosted on a server of the one or more servers;
generating, by the device, responsive to determining the configuration change associated with the virtual server, a service fingerprint for the virtual server, the service fingerprint including a domain name service (DNS) alias for a virtual internet protocol (IP) address of the virtual server, a port number of the virtual server serving a secure socket layer (SSL) certificate of the virtual server, an IP address serviced by the device, and the SSL certificate;
transmitting, by the device, the generated service fingerprint to a web service to identify whether the device is under attack; and
receiving, by the device from the web service, a notification that the device is under attack, responsive to the web service comparing the generated service fingerprint with data received by the web service from an agent.
2. The method of claim 1 , wherein receiving the notification that the device is under attack is further responsive to the web service determining that i) the SSL certificate does not match a second SSL certificate received from the agent that attempted to establish a secure connection with the virtual server, or ii) that the IP address of the virtual server does not match a second IP address received from the agent.
3. The method of claim 2 , wherein the notification indicates that the attack is a man-in-the-middle (MITM) attack.
4. The method of claim 1 , wherein determining the configuration change associated with the virtual server comprises determining, by the device, that the SSL certificate of the virtual server has replaced an expired SSL certificate of the virtual server.
5. The method of claim 1 , wherein determining the configuration change associated with the virtual server comprises determining, by the device, that the virtual server is associated with a new IP address not previously serviced by the virtual server.
6. The method of claim 1 , wherein determining the configuration change associated with the virtual server comprises determining, by the device, that the virtual server services a new DNS name not previously serviced by the virtual server.
7. The method of claim 1 , wherein the service fingerprint does not include a private key corresponding to the SSL certificate.
8. The method of claim 1 , further comprising generating, by the device, a unique verification key to allow the virtual server to implement a private extension of an SSL handshake when the SSL certificate is served based on the unique verification key.
9. The method of claim 8 , wherein generating the service fingerprint further comprises generating, by the device, the service fingerprint including the unique verification key.
10. The method of claim 8 , further comprising:
receiving, from the agent, a request to establish a secure connection between the agent and the virtual server; and
transmitting, by the device, the SSL certificate and the unique verification key to the agent, responsive to receiving the request to establish the secure connection.
11. A system for improving security of secure socket layer (SSL) communication, comprising:
a device including one or more processors and a memory and intermediary to a plurality of clients and one or more servers, the device configured to:
determine a configuration change associated with a virtual server executing on the device, the virtual server configured as a named entity of the device that at least one client of the plurality of clients uses to access applications hosted on a server of the one or more servers;
generate, responsive to determining the configuration change associated with the virtual server, a service fingerprint for the virtual server, the service fingerprint including a domain name service (DNS) alias for a virtual internet protocol (IP) address of the virtual server, a port number of the virtual server serving a secure socket layer (SSL) certificate of the virtual server, an IP address serviced by the device, and the SSL certificate;
transmit the generated service fingerprint to a web service to identify that the device is under attack; and
receive, from the web service, a notification that the device is under attack, responsive to the web service comparing the generated service fingerprint with data received by the web service from an agent.
12. The system of claim 11 , wherein to receive the notification that the device is under attack, the device is further configured to receive the notification responsive to the web service determining that i) the SSL certificate does not match a second SSL certificate received from the agent that attempted to establish a secure connection with the virtual server, or ii) that the IP address of the virtual server does not match a second IP address received from the agent.
13. The system of claim 12 , wherein the notification indicates that the attack is a man-in-the-middle (MITM) attack.
14. The system of claim 11 , wherein the device is further configured to determine that the SSL certificate of the virtual server has replaced an expired SSL certificate of the virtual server.
15. The system of claim 11 , wherein the device is further configured to determine that the virtual server is associated with a new IP address not previously serviced by the virtual server.
16. The system of claim 11 , wherein the device is further configured to determine that the virtual server services a new DNS name not previously serviced by the virtual server.
17. The system of claim 11 , wherein the service fingerprint does not include a private key corresponding to the SSL certificate.
18. The system of claim 11 , wherein the device is further configured to generate a unique verification key to allow the virtual server to implement a private extension of an SSL handshake when the SSL certificate is served based on the unique verification key.
19. The system of claim 18 , wherein the device is further configured to generate the service fingerprint to include the unique verification key.
20. The system of claim 18 , wherein the device further comprises a secure connection interface configured to:
receive, from the agent, a request to establish a secure connection between the agent and the virtual server; and
transmit the SSL certificate and the unique verification key to the agent, responsive to receiving the request to establish the secure connection.