On the evaluation of X.509 certificate processing in Transport Layer Security interceptors

The Transport Layer Security (TLS) interceptors are applications running on client devices or on separate machines that filter TLS-protected traffic between two endpoints. They split the original TLS channel into two TLS channels and they might significantly impact the security obtained. They are increasingly used and installed by numerous end users or network administrators. It is necessary to assess X.509 certificate processing in TLS interceptors since flaws or problems in performing this task correctly and completely may weaken the client’s communication security. We define X.509-related tests, which are divided into five categories based on which part(s) of the X.509 certificate fields or extensions get analyzed. We propose a method for automatically generating wrong, malformed, or unusual X.509 certificates (and chains) and configuration files suitable for the most common web servers, like Apache or Nginx. We deploy the generated configuration files on the TLS-aware web servers in an experimental testbed set up for testing the behavior of four selected TLS interceptors, two antivirus, and two proxy applications running on different operating systems. We report the results obtained, underlining the need to test in-depth such applications so that they would not decrease the security levels achieved by the clients.