Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make the CA details and filename configurable #5386

Open
Prinzhorn opened this issue May 30, 2022 · 4 comments · May be fixed by #5441
Open

Make the CA details and filename configurable #5386

Prinzhorn opened this issue May 30, 2022 · 4 comments · May be fixed by #5441
Assignees
@Prinzhorn
Labels
kind/feature New features / enhancements

Comments

@Prinzhorn
Copy link
Member

Problem Description

I'm wrapping mitmproxy and I want to avoid confusion by not calling my root certs mitmproxy-ca.pem etc. And also by not having my root cert be issued by mitmproxy. So that if you're also using mitmproxy it's clear which is which.

Proposal

CONF_BASENAME looks like it's almost meant to be an option here:

mitmproxy/mitmproxy/options.py

Line 7 in 8f23a26

CONF_BASENAME = "mitmproxy"

and the organization and cn arguments are already there, but unused in our codebase:

mitmproxy/mitmproxy/certs.py

Line 393 in 8f23a26

path: Path, basename: str, key_size: int, organization=None, cn=None

I think having these three things be configurable would already be amazing.

Would we want something like ca_basename, ca_organization and ca_cn in core?

Alternatives

I'm aware of https://docs.mitmproxy.org/stable/concepts-certificates/#using-a-custom-certificate-authority but I'd rather have mitmproxy manage the cert for me. It would also still look for the same filename.
@Prinzhorn Prinzhorn added the kind/feature New features / enhancements label May 30, 2022
@mhils
Copy link
Member

mhils commented Jun 2, 2022

Not providing these options has been an intentional strategic decision, we don't want to make it overly easy to hide that mitmproxy is intercepting a connection. It lowers the bar for not-so-skilled attackers, while providing no tangible benefit to our own users.

@mhils mhils closed this as not planned Won't fix, can't repro, duplicate, stale Jun 2, 2022
@Prinzhorn
Copy link
Member Author

Prinzhorn commented Jun 3, 2022 •
edited

I never looked at it this way, makes sense. I don't think this applies to basename though?

make it overly easy to hide that mitmproxy is intercepting a connection

I don't want to hide it, I want to avoid confusion and improve the experience. If anything I want to make it more clear what is intercepting the connection. I'd be totally fine with if you set ca_organization to Custom that the cert will have Custom (mitmproxy) or mitmproxy (Custom) as the actual organization.

@mhils
Copy link
Member

mhils commented Jun 3, 2022

I never looked at it this way, makes sense. I don't think this applies to basename though?

Agreed, basename is fine.

I'd be totally fine with if you set ca_organization to Custom that the cert will have Custom (mitmproxy) or mitmproxy (Custom) as the actual organization.

This is something I'd definitely be happy to support. Contributions welcome. :)

@Prinzhorn
Copy link
Member Author

Great, I'll reopen this and will look into it within the next weeks or years 😄 . Apart from the hardcoded mitmproxy basename in mitmweb HTML this should be somewhat trivial.

@Prinzhorn Prinzhorn reopened this Jun 3, 2022
@Prinzhorn Prinzhorn self-assigned this Jun 3, 2022
Prinzhorn added a commit to Prinzhorn/mitmproxy that referenced this issue Jun 29, 2022
@Prinzhorn
Allow configuring certain CA details, fixes mitmproxy#5386
8be577b
@Prinzhorn Prinzhorn linked a pull request Jun 29, 2022 that will close this issue
Allow configuring certain CA details, fixes #5386 #5441
Open
2 tasks
@Prinzhorn Prinzhorn linked a pull request Jan 11, 2023 that will close this issue
Open
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Prinzhorn Prinzhorn

Labels
kind/feature New features / enhancements
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Allow configuring certain CA details, fixes #5386 Prinzhorn/mitmproxy
2 participants
@Prinzhorn @mhils