Re: SSL

[Eric Rescorla <ekr () rtfm com>]

Frederick M Avolio <fred () avolio com> writes:

> At 08:18 AM 10/16/01 -0400, Crumrine, Gary L wrote:
>
> > ... If I allow SSL outbound, and a user
> > browses a web site that is corrupt with something harmful like NIMDA, is it
> > possible that they will infect my network...
>
> Yes. The firewall cannot examine it because the data is encrypted. SSL 
> "proxies" are just circuit gateways. I know of no firewall that has a true 
> SSL proxy wherein the data is encrypted between the firewall and the 
> client, and the firewall and the server, but is in cleartext on the 
> firewall. It is possible to do, but few customers (Paul Roberson) ask for it.
It's only possible to do this if the client cooperates. Otherwise, it
gets blocked by the same mechanisms that stop a man-in-the-middle
attack on SSL.

-Ekr
_______________________________________________
firewall-wizards mailing list
firewall-wizards () nfr com
http://list.nfr.com/mailman/listinfo/firewall-wizards