Home / server / Questions / 793637
Accepted
Fraggle
Asked: 2016-08-04 07:13:17 +0800 CST

Does TLS 1.2 prevent MITM sniffing with proxy certificate?

  • 772

I've used jMeter proxy to inspect SSL traffic coming from my iPhone, by installing the jMeter certificate on the iPhone and then configuring my wifi on the phone to use the jMeter proxy.

If I want to prevent this MITM sniffing for a particular website/server can I just enforce TLS 1.2 on the server?

Does TLS1.2 actually prevent this kind of MITM sniffing if it is enforced throughout?

ssl iphone man-in-the-middle tls

1 Answers

  1. Best Answer

    Man in the middle is prevented if the client checks that it gets exactly the expected certificate. This is called certificate or public key pinning. This is not a feature of any TLS version including TLS 1.2 but must be implemented explicitly in the client. For more information and example code see OWASP: Certificate and Public Key Pinning.

    • 1