HTTPS拦截
我对SSL了解不多，但我读过一些东西，我想知道是否有可能拦截客户端和服务器之间的通信（例如，公司可以监控员工的数据传输？）。 我以为这是一项艰巨的任务，但看起来很简单。当客户端请求 https 连接时，可以指示路由器拦截密钥交换并将其自己的公钥发送到服务器和客户端（进一步可以对漏洞流量进行编码/解码）。 这是真的吗，还是我误会了什么？
I don't know much about SSL, but I've read something and I was wondering if it's possible to intercept the communication between client and server (for example, a company can monitor employees data transfer?).
I thought it was a difficult task, but it looks like that it is very simple. When a client requests a https connection the router can be instructed to intercept the key exchange and send to the server and the client it's own public keys (further it can encode/decode the hole traffic).
Is it true, or I'm misunderstanding something?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您控制下的 CA 在员工使用的所有浏览器中都受信任，则很容易实现：
公司代理需要动态创建类似于原始证书的证书，并将这些证书提供给客户端。所有信息都可以取自真实证书，唯一的区别在于 CA 签署证书。
然而，至少 google chrome 会抱怨 google 拥有的域，因为它们有一个明确的白名单，CA 可以在该白名单上签署用于 google 域的证书。
If a CA under your control is trusted in all browsers used by employees it's easily possible:
The company proxy needs to create certificates resembling the original certificate on the fly and present those certificates to the clients. All information could be taken from the real certificate, the only difference would be in the CA signing the certificate.
However, at least google chrome would complain for google-owned domains since they have an explicit whitelist on which CAs may sign certificates used for google domains.
在公司网络中，公司自己的 SSL CA 通常安装在所有计算机上。在这种情况下，公司代理可以提供浏览器接受的公司证书，并读取流量。
如果您查看证书详细信息（在浏览器的地址栏中找到），您可以检查它是否是远程服务器的预期证书，或者是否是公司创建的另一个证书。
您可以使用例如 http://www.sslshopper.com/ ssl-checker.html#hostname=www.google.com 检查它应该是什么证书。 （显然将主机名更改为您想要使用的任何服务器）
At a company network, the companies own SSL CA:s are often installed on all machines. In this case, a company proxy can present a company certificate which will be accepted by the browser, and read the traffic.
I you look at the certificate details (found in your browser's address bar), you can check if it is the expected certificate of the remote server, or if it is another certificate created by the company.
You can use for example http://www.sslshopper.com/ssl-checker.html#hostname=www.google.com to check what certificate its supposed to be. (obviously change the hostname to whatever server it is you want to use)
这部分是正确的：您描述的过程可以工作，但客户端会被通知服务器证书不是预期的证书（未经认证，分配给另一个站点）。因此，在他们不知情的情况下透明地做到这一点是不可能的，但这在企业环境中可能是可以接受的。
It's partially true: the process you describe would work but the client would be notified that the server certificate is not the expected one (not certified, assigned to another site). So it's not possible to do it transparently and without them knowing, but that may be acceptable in a corporate environment.