Readers are encouraged to refer to those studies to better understand the trade-offs in the design, implementation and deployment of a TLS proxy. Industrial and academic studies have been conducted on TLS proxies and the associated benefits and risks. | TLS CLIENT |-| Stack | | Stack |-| TLS SERVER | A TLS proxy may leverage the session handshake information as well as decrypted traffic data to satisfy organization’s policy requirements. As a result, the TLS proxy is able to decrypt the traffic from each side of the TLS session for various purposes, and then optionally re-encrypt the traffic before forwarding it to the other side of the session. Based on an organizational policy, it may proxy a TLS handshake by terminating it on the client side and starting a new handshake with the server. A TLS proxy is deployed between endpoints such as TLS clients and servers. Selectively decrypt based on policyĪ TLS proxy refers to a set of network functions and products that intercept TLS sessions per an organizational security policy. Use caution when enforcing policy with SNI Provide the ability to enforce policy without intercept Implement special measures to handle session resumption

Detect and handle protocol version downgrade markers Maintain security posture and limit modifications Securely provision within the administrative domain Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents () in effect on the date of publication of this document. Copyright NoticeĬopyright (c) 2020 IETF Trust and the persons identified as the document authors. This Internet-Draft will expire on September 5, 2020. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as 'work in progress.' Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. The list of current Internet-Drafts is at.

Note that other groups may also distribute working documents as Internet-Drafts. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. This document defines a TLS proxy and discusses a wide range of security requirements to guide TLS proxy implementations. TLS proxies are widely deployed by organizations to enable security features and apply enterprise policies. TLS Proxy Best Practice OPSEC Working Groupĭraft-wang-tls-proxy-best-practice-01 Abstract

Performing a tls handshake firefox