[mdlug] decrypting ssl connections on the fly?

[Carl T. Miller]

Flavio daCosta wrote:
> On 11/24/2006 09:37 AM, Carl T. Miller wrote:
>> Aha, let me speculate even more wildly.  I wonder if it works
>> like a proxy.  Whenever an ssl connection request is sent,
>> it sends its own connection request, thus it can unencrypt
>> what returns.  It would then need to encrypt it again with
>> fake keys pretending to be the original source.
>
> Yes, they are proxy servers (doing a Man In The Middle.)  The one last
> detail is that the client machines [browsers] must install the proxy's
> root certificate into the browser so they accept the generated /fake/
> cert without disruption.

Okay, that's the part that I was missing.  It makes sense,
ssl is not broken and all is well with the world.

c