Hello all!
(I'm a new member of this mailing list, so if the answer to my
question is already somewhere in the archives please point me there.)
(I've done some searching and couldn't find anything useful.)
In the context of the Perspectives project (
http://www.cs.cmu.edu/~perspectives ) (the Perspectives developers
mailing list is also put in CC, so please keep them there) I want to
implement an HTTPS proxy server that does the following:
* when it receives the CONNECT request it connects to the
designated target, but,
* it monitors the connection (thus "sniffing" the connection) in
order to obtain the SSL certificate that the server uses;
* it compares the SSL certificate fingerprint to those reported by
the notary servers (part of the Perspectives project infrastructure),
and
* if the fingerprints match I stop "sniffing" the connection and
just continue proxying;
* if the fingerprints don't match I just drop the connection;
So my problem is the following: how can I extract the SSL
certificate from the connection without reimplementing the TLS
protocol?
For example I assume that there is a method (which I'm not aware
of and want to find it), in which I just feed the data that comes from
the server to the client (ignoring the other channel of the
connection), into a parser, which at the end will spit out the
certificate (or at least decode the TLS packets as they fly by).
(I bet that there are functions in the openssl library, but it's
hard to spot them in the reference documentation.)
And a second question (related to security): I guess that there is
no way to trick my proxy by switching to another certificate once the
first one was already sent? For example I guess there is no way in
which the server can re-initiate the TLS handshake (reusing the same
connection) by using another certificate than the one previously sent.
Thanks for your support,
Ciprian.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager majord...@openssl.org
