Open numericOverflow opened 1 month ago
Just a random passer by here, I'd suggest your IT department replace MITM with endpoint security.
MITMing traffic like this is very frowned upon and you are basically on your own with issues.
Just a random passer by here, I'd suggest your IT department replace MITM with endpoint security.
MITMing traffic like this is very frowned upon and you are basically on your own with issues.
I personally agree with you, but that decision is no where near my realm of influence. I might as well file a complaint with the Great Red Spot on Jupiter asking that it be a bit less windy.
I am running into this same issue as #299, but have some additional info referencing that issue.
Whenever I try to register behind a seamless MITM SSL inspection proxy, I (naturally) get an ssl handshake error:
I know I am behind a corporate firewall/proxy that does MITM inspection. Obviously, this is known to cause SSL issues as in general, anything MITM is frowned upon from a privacy standpoint, but in this case its the "good guys"™ doing it. Is there a way to override the cert to allow the corp MITM to connections occur?
I would never want to do this in a private situation because it undermines the assumptions of privacy, but for a work scenario where the MITM is required and I'm OK with it for governance, can this be done?
I've tried a couple things so far: 1) Extracting the trusted CA's from a windows machine, then adding them to the JVM's CA keystore, but that didn't work. (JAVA_HOME\lib\security\cacerts).
I used
certutil
to extract the certs, andkeystore
tool import to the abovecacerts
store.This should have the MITM CA, but can't see exactly which CA is used, so can't be sure, but seems not to help at all. Got same errors as above prior to modifying cacerts store.
2) Next I tried replacing the whisper.store with the cacerts I built out above (which should have MITM root certs) as suggested here when the certs got updated to backport to older versions, but I get a new error
I'm assuming this might be due to the fact that the cert is hardcoded somewhere to stop MITMs.
Thoughts?? I'm hitting my wall of knowledge/options without some suggestions.