TLS policy enforcement at a tunnel gateway
Disclosed are various approaches for verifying the compliance of a TLS session with TLs policies. Traffic between an application and a destination server can be routed through a TLS gateway. The TLS gateway can inspect TLS handshake messages for compliance with TLS policies.
1. A system for authenticating a user and determining a device posture during authentication, comprising:
at least one computing device comprising a processor and a memory; and
a tunnel gateway executed by the at least one computing device, the tunnel gateway causing the at least one computing device to at least:
obtain a transport layer security (TLS) message according to a TLS handshake over a virtual private network (VPN) tunnel established between a client device and the tunnel gateway, the TLS message comprising a connection attempt between a destination server and the client device, wherein the TLS message is received from the destination server and is intended for an application installed on the client device;
identify an aspect of the connection attempt based upon the TLS handshake;
identify the application based upon data embedded into the TLS message;
identify a TLS policy corresponding to the application, wherein the TLS policy is applied to network traffic for the application based on a Virtual Private Network (VPN) configuration for the application received by the client device from a management service, and wherein the tunnel gateway stores a pinned certificate in association with the destination server based on the TLS policy; and
terminate the connection attempt between the client device and the destination server in response to determining that the aspect of the connection attempt based upon the TLS handshake violates the TLS policy, wherein the TLS policy is violated if a certificate presented by the destination server in the TLS handshake with the client device does not match the pinned certificate stored on the tunnel gateway.
2. The system of claim 1 , wherein the connection attempt between the client device and the destination server is terminated by the tunnel gateway in response to a server name indication (SNI) or a TLS version specified by the TLS message comprising an unapproved value for the identified application.
3. The system of claim 1 , wherein the tunnel gateway causes the at least one computing device to at least terminate the connection attempt in response to a cipher suite specified by the TLS message comprising an unapproved cipher suite, wherein at least one approved cipher suite is associated with the application in the tunnel gateway.
4. The system of claim 1 , wherein the tunnel gateway causes the at least one computing device to at least terminate the connection attempt in response to the certificate provided by the destination server being signed by an unapproved certificate authority.
5. The system of claim 1 , wherein the tunnel gateway causes the at least one computing device to at least cause a push notification to be transmitted to the client device in response to terminating the connection attempt, the push notification comprising a message indicating that the connection attempt has been terminated.
6. The system of claim 1 , wherein the tunnel gateway further causes the at least one computing device to at least:
update the pinned certificate stored on the tunnel gateway to a new pinned certificate without updating the application on the client device or any certificates on the client device.
7. A method comprising:
obtaining a transport layer security (TLS) message according to a TLS handshake over a virtual private network (VPN) tunnel established between a client device and a tunnel gateway, the TLS message comprising a connection attempt between a destination server and the client device, wherein the TLS message is received from the destination server and is intended for an application installed on the client device;
identifying a property of the connection attempt based upon the TLS handshake;
identifying the application based upon data embedded into the TLS message;
identifying a TLS policy corresponding to the application, wherein the TLS policy is applied to network traffic for the application based on a Virtual Private Network (VPN) configuration for the application received by the client device from a management service, and wherein the tunnel gateway stores a pinned certificate in association with the destination server based on the TLS policy; and
terminating the connection attempt between the client device and the destination server in response to determining that the property of the connection attempt based upon the TLS handshake violates the TLS policy, wherein the TLS policy is violated if a certificate presented by the destination server in the TLS handshake with the client device does not match the pinned certificate stored on the tunnel gateway.
8. The method of claim 7 , wherein the connection attempt between the client device and the destination server is terminated by the tunnel gateway in response to a server name indication (SNI) or a TLS version specified by the TLS message comprising an unapproved value for the identified application.
9. The method of claim 7 , wherein the connection attempt is terminated in response to a cipher suite specified by the TLS message comprising an unapproved cipher suite, wherein at least one approved cipher suite is associated with the application in the tunnel gateway.
10. The method of claim 7 , wherein the connection attempt is terminated in response to the certificate provided by the destination server being signed by an unapproved certificate authority.
11. The method of claim 7 , further comprising causing a push notification to be transmitted to the client device in response to terminating the connection attempt, the push notification comprising a message indicating that the connection attempt has been terminated.
12. The method of claim 7 , further comprising:
updating the pinned certificate stored on the tunnel gateway to a new pinned certificate without updating the application on the client device or any certificates on the client device.
13. A non-transitory computer-readable medium comprising executable instructions implementing a tunnel gateway, the instructions, when executed, causing at least one computing device to at least:
obtain a transport layer security (TLS) message according to a TLS handshake over a virtual private network (VPN) tunnel established between a client device and the tunnel gateway, the TLS message comprising a connection attempt between a destination server and the client device, wherein the TLS message is received from the destination server and is intended for an application installed on the client device;
identify an aspect of the connection attempt based upon the TLS handshake;
identify the application based upon data embedded into the TLS message;
identify a TLS policy corresponding to the application, wherein the TLS policy is applied to network traffic for the application based on a Virtual Private Network (VPN) configuration for the application received by the client device from a management service, and wherein the tunnel gateway stores a pinned certificate in association with the destination server based on the TLS policy; and
terminating the connection attempt between the client device and the destination server in response to determining that the aspect of the connection attempt based upon the TLS handshake violates the TLS policy, wherein the TLS policy is violated if a certificate presented by the destination server in the TLS handshake with the client device does not match the pinned certificate stored on the tunnel gateway.
14. The non-transitory computer-readable medium of claim 13 , wherein the connection attempt between the client device and the destination server is terminated by the tunnel gateway in response to a server name indication (SNI) or a TLS version specified by the TLS message comprising an unapproved value for the identified application.
15. The non-transitory computer-readable medium of claim 13 , wherein the tunnel gateway causes the at least one computing device to at least cause a push notification to be transmitted to the client device in response to terminating the connection attempt, the push notification comprising a message indicating that the connection attempt has been terminated.
16. The non-transitory computer-readable medium of claim 13 , further comprising instructions, which when executed, cause at least one computing device to at least: update the pinned certificate stored on the tunnel gateway to a new pinned certificate without updating the application on the client device or any certificates on the client device.