View source for How does HTTPS inspection work with SafeSquid?


[[File:Https inspection flow.PNG|center|Https inspection flow.PNG|link=]]

1. When user/client&nbsp;request a secure webpage say&nbsp;''https://www.xyz.com'' (a HTTPS site) from the&nbsp;browser, SafeSquid will get CONNECT request from the client browser.

2. SafeSquid will check configuration whether the user&nbsp;is&nbsp;allowed or denied to access to ''https://www.xyz.com''.&nbsp;&nbsp;If access is denied to such websites then,&nbsp;SafeSquid will send blocked template to that users browser and closes connection.

3. If access to ''https://www.xyz.com'' allowed to client&nbsp;then SafeSquid checks whether SSL inspection enabled for site or not?

If HTTPS&nbsp;inspection is disabled then SafeSquid resolve IP of ''xyz.com'' with the help of DNS and establishes connection to the ''www.xyz.com''. Client browser checks the trust of the ''www.xyz.com'' server. Client browser encrypts data using server public key and sends back to server. There is no possibility for SafeSquid to check what client is sending to server and what is coming to clients browser from the server. SafeSquid will not check what is going on inside connection.

If HTTPS&nbsp;inspection enabled then

i)&nbsp;&nbsp;SafeSquid resolves IP of ''www.xyz.com'' with the help of DNS and establishes connection to the ''www.xyz.com''.

ii) SafeSquid performs SSL handshake with server.

SafeSquid sends client hello message to the server in the process of SSL handshake.

SafeSquid will get server public key in server hello message from the server in the process of SSL handshake.

SafeSquid will check the trust of the ''www.xyz.com'' certificate with the help of trusted root ca bundle.

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;If SafeSquid finds that certificate expired or invalid then SafeSquid allows or blocks the access to the site based on configuration.

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;If SafeSquid finds that server certificate is valid then SafeSquid performs SSL handshake with client.

After this SafeSquid uses server certificate (public key) to encrypt the data that will be sent to server. Further server&nbsp;can decrypt the data sent by the SafeSquid and returns response accordingly.

iii) SafeSquid performs SSL handshake with client.

Client browsers send client hello message to the SafeSquid server in the process of SSL handshake.

SafeSquid will check whether public key and private key for ''www.xyz.com'' site does&nbsp;exists in the disk or not.&nbsp;If site does&nbsp;not exist&nbsp;then SafeSquid will create public key and private key for&nbsp;''www.xyz.com'' and store them in the disk for reusability.

SafeSquid will send back created server public key in server hello message to the client browsers in the process of SSL handshake with client.

Client browsers further&nbsp;verify the trust of the certificate (public key) sent by SafeSquid. To verify the trusted certificate clients need to import Safesquid.cer certificate into their browsers trusted authority.

After this client uses SafeSquid created certificate (public key) to encrypt the data that will be sent to SafeSquid. SafeSquid can decrypt the data sent by clients with the help of created private key and checks the data and sends it to server by encrypting data with the server public key.