Hi everyone, I’ve been trying to understand how MiTM setups like a transparent proxy work.

Obviously, the use-case here is in a personal scope: I’d like to inspect the traffic of some of my machines. I am aware that Squid can be a transparent proxy, and some might use the Burp Suite to analyse network traffic.

Could someone explain the basic networking and the concept of certificates in this scenario? I feel like I don’t understand how certificates are used well enough.


For example: I realise that if someone inserts a root certificate in the certificate store of an OS, the machine trusts said CA, thus allowing encrypted traffic from the machine to be decrypted. However, say the machine was trying to access Amazon; won’t Amazon have its own certificate? I don’t know how I’m confused about such a simple matter. Would really appreciate your help!

  • MigratingtoLemmy@lemmy.worldOP
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 year ago

    Ah, I see. I suppose I got a bit confused, and wanted to confirm how encryption would work for outbound traffic. Just to be sure: when an application wants to send encrypted data to a website/service on the Internet, it will use the respective certificate for said website. However, if one runs a transparent proxy in the middle and inserts a root certificate in the certificate store of the application, said certificate becomes valid (and the de-facto pick) for all websites, and this is what the client begins to use for everything.

    Is that how it works?