Deep Packet Inspection - Certificate

[googlemad]

We have set up Deep Packet Inspection on our wireless network so that when terms such as 'naked women' are typed into Google it removes all the women without clothes on.

 

Anyway this works, BUT there is a HUGE problem with it in that unless a Watchguard HTTPS certificate is somehow installed on the device (And this device could literally be anything!) a 'Certificate warning' pops up for any secure sites such as Google / Google Mail etc rendering the whole thing unusable. But if we turn it off then people can access the naked women again so stuck between a rock and a hard place really!

 

Is there any way that when they connect to the WiFi the certificate is part of the connection? I'm a bit confused as to how to go about it!

[clodhopper]

DPI is a complete nightmare with devices you don't own / have control of.

 

When you think about it DPI is flawed really as you're breaking something that should be unbreakable :-/

 

We've got Watchguard & have lots of fun with DPI but talking to others with other systems they're having just as many problems.

[Gaz]

I install the cert manually which is a PITA but its the only way as clodhopper says. We don't intercept things like online shopping, banking or webmail.

 

It would be good to have some sort of captive portal that could automatically sense if the certificate has been installed and then let them browse but I can't imagine that is an easy thing to make happen.

[plexer]

If you have an enterprise PKI already setup then the device to which your users are connecting should have a subordinate CA certificate installed so that it can generate ssl certs on the fly to give to the requesting devices, because those devices will already trust your enterprise root ca they will trust your subordinate device.

 

Simples.

 

Ben