Has anyone got an ELI5 presentation regarding SSL encryption ?

[caffrey]

I know how SSL encryption works and how it affects filtering, but I've been tasked to present it to a panel.

 

What I'm looking for is a simple short presentation that explains in very easy terms what SSL encryption is and why it's important for a web filter to be able to decrypt and inspect SSL traffic, before I start writing one has anyone got anything ?

[Opendium_Steve]

I haven't got a presentation, but I hope this explanation helps a bit:

 

A traditional web proxy sees all of the unencrypted data that goes between the browser and web server. This includes the full web address the client is requesting, any data the client is submitting (e.g. the contents of a form, any files being uploaded, etc) and any data the server is sending the client. Most web filters look up the requested web address in their internal database and decide whether or not to allow access. Some web filters also analyse the data being sent and received.

 

When you access an encrypted website through a traditional web proxy, the web proxy/filter can only see the host name part of the web address and none of the data being sent/received. Web filters can still do some filtering based on the host name, but this obviously isn't as good as knowing the fill address, and they can't do any analysis on the data. Some clients also insist on connecting to just an IP address, rather than a host name, and that is something that can't be sensibly filtered.

 

An increasing number of devices (iPads, etc.) have very poor support for traditional web proxies, so many filtering systems also provide a "transparent" proxy, which does not require any direct support from the browser. The browser thinks its talking directly to the web server, but the connection is really being intercepted and redirected to the proxy/filter. When accessing an unencrypted website through a transparent proxy, the proxy/filter can work in pretty much the same way as the traditional non-transparent proxy/filter does.

 

Real problems come when you try to access encrypted websites through a transparent proxy - the proxy/filter only knows the IP address of the web server. The host name, web address and any data being sent/received are encrypted and therefore can't be examined by the filter. Some filters are able to examine the SSL handshake to retrieve the host name of the web server without doing full "man in the middle" decryption on the encrypted traffic.

 

As more and more services move to using encryption as standard, just having the host name of the server isn't good enough to make a reasonable stab at filtering. The solution here is for the filter to become a "man in the middle" - the browser connects to the proxy/filter, which pretends to be the web server, and the proxy/filter pretends to be the browser and connects to the web server. Secure webservers present a certificate to the client so that the client knows its talking to the real web server - the proxy/filter needs to forge the web server's certificate, and this requires the browser to have already been told to trust any certificates issued by the proxy (by installing the proxy's certificate on the browser, either manually or through something like Active Directory).

 

The advantage is that the filter works just as well when accessing encrypted websites as it does when accessing unencrypted websites. The disadvantages are that you need to install a certificate on every device, not all applications will bother to use that certificate, and you could end up decrypting sensitive data (e.g. banking transactions). For these reasons, you have to exclude some websites from being decrypted and just accept that those sites won't be filtered.

[caffrey]

That helps, thanks