iRule to Decide which VS to use.

I 100% understand what your saying but 2 things come to mind.

 

 

1. If this is true how come products such as websense can perform URL filtering on HTTPS traffic that they dont perform SSL interception for.

 

2. Also if you look at a packet capture of a SSL connection the 4th packet in the connection is a "Client Hello" which has the hostname in it. At this point the server has not responded.

1. If this is true how come products such as websense can perform URL filtering on HTTPS traffic that they dont perform SSL interception for. i think websense has to integrate with proxyto block by url.

 

 

2. Also if you look at a packet capture of a SSL connection the 4th packet in the connection is a "Client Hello" which has the hostname in it. At this point the server has not responded.is it server_name tls extension? if so, it is SNI which we are talking.

 

 

Transport Layer Security (TLS) Extensions

 

http://www.ietf.org/rfc/rfc3546.txt

1. If this is true how come products such as websense can perform URL filtering on HTTPS traffic that they dont perform SSL interception for.

 

 

You must be mistaken. That is not possible.

 

 

2. Also if you look at a packet capture of a SSL connection the 4th packet in the connection is a "Client Hello" which has the hostname in it. At this point the server has not responded.

 

 

http://en.wikipedia.org/wiki/Server_Name_Indication

Actually this looks like the solution you were asking for... I did not know about this SNI thingy... it's sounds really cool!

 

 

https://devcentral.f5.com/Tutorials/TechTips/tabid/63/articleType/ArticleView/articleId/1086451/Multiple-Certs-One-VIP-TLS-Server-Name-Indication-via-iRules.aspx

1. Websense probably has a root cert/key that the browser trusts and can therefore generate a server cert/key dynamically for the requested hostname. Without TLS SNI, the requested hostname could be determined by Websense making a request (with TLS SNI if the client used it) or the IP address and checking the subject(s) in the server cert.

 

 

2. The client is using TLS SNI to tell the server in the unencrypted portion of the client hello which hostname it is requesting. If all of your clients support TLS SNI you could use this feature on LTM to support multiple server certs on the same virtual server.

 

 

Aaron

SNI will be in the client's CLIENTHELLO message. The fourth packet of the connection is first packet of the SSL negotiation after the TCP three-way handshake. Toward the bottom of your capture you'll see a section in the CLIENTHELLO message for extensions, and one called "Server Name".

 

 

Websense, I believe, is also capable of doing SSL man-in-the-middle, which is probably what you've encountered. BIG-IP can also do SSL man-in-the-middle, called ProxySSL, but that won't allow you to do redirects based on the URI.

1. Websense probably has a root cert/key that the browser trusts and can therefore generate a server cert/key dynamically

 

 

That sounds like defeating the third party authority idea behind SSL certs.... in a way, no?

 

 

But then again, googling a quick bit I saw this sentence :

 

 

To implement SSL decryption for your end users, you need a root certificate on each client machine that acts as a Certificate Authority for SSL requests to the cloud proxy.

 

 

In this doc: http://www.websense.com/content/support/library/web/hosted/admin_guide/ssl_enable.aspx

 

 

I dont know Wensense, but would be curious to know if they are doing anything more interesting that.

In my humble opinion SSL is pretty much broken. The article gives you a good idea of that, install a 'dummy' CA on your company PCs and hey presto, no security and privacy for your users.

 

 

I specifically use self-signed certificates for my personal 'stuff' as I can rely on those and not have to trust a CA or a company administrator.

 

 

Here's a news story on two CAs that have provided SSL 'skeleton' keys to private companies and don't think they don't all do it for government organisations: http://www.theregister.co.uk/2012/02/14/trustwave_analysis/

 

 

I agree. I love this proposed alternative: http://en.wikipedia.org/wiki/Convergence_(SSL)

 

 

The author explains eveything, and he knows what he's talking about, here: http://www.youtube.com/watch?v=Z7Wl2FW2TcA

Thanks for your help everyone. We ended up using the SNI feature, in TLC. Which appears to work greate we can present diffrent SSL certs based on the Client request so spot on.

 

 

Also i dont understand how it works but Websense can perform url filtering on SSL traffic without Certs and proxy mode, strange but true.