NAME<\/a> IO::Socket::SSL::Intercept \u2212\u2212 SSL interception (man in the middle)<\/p>\n use IO::Socket::SSL::Intercept; This module provides functionality to clone certificates and sign them with a proxy certificate, thus making it easy to intercept SSL<\/small> connections (man in the middle). It also manages a cache of the generated certificates.<\/p>\n Intercepting SSL<\/small> connections is useful for analyzing encrypted traffic for security reasons or for testing. It does not break the end-to-end security of SSL,<\/small> e.g. a properly written client will notice the interception unless you explicitly configure the client to trust your interceptor. Intercepting SSL<\/small> works the following way:<\/p>\n
SYNOPSIS<\/a>
DESCRIPTION<\/a>
How Intercepting SSL Works<\/a>
METHODS<\/a>
AUTHOR<\/a> <\/p>\n
\nNAME <\/a> <\/h2>\n
SYNOPSIS <\/a> <\/h2>\n
# create interceptor with proxy certificates
my $mitm = IO::Socket::SSL::Intercept\u2212>new(
proxy_cert_file => ‘proxy_cert.pem’,
proxy_key_file => ‘proxy_key.pem’,
…
);
my $listen = IO::Socket::INET\u2212>new( LocalAddr => .., Listen => .. );
while (1) {
# TCP accept new client
my $client = $listen\u2212>accept or next;
# SSL connect to server
my $server = IO::Socket::SSL\u2212>new(
PeerAddr => ..,
SSL_verify_mode => …,
…
) or die “ssl connect failed: $!,$SSL_ERROR”;
# clone server certificate
my ($cert,$key) = $mitm\u2212>clone_cert( $server\u2212>peer_certificate );
# and upgrade client side to SSL with cloned certificate
IO::Socket::SSL\u2212>start_SSL($client,
SSL_server => 1,
SSL_cert => $cert,
SSL_key => $key
) or die “upgrade failed: $SSL_ERROR”;
# now transfer data between $client and $server and analyze
# the unencrypted data
…
}<\/p>\nDESCRIPTION <\/a> <\/h2>\n
How Intercepting SSL Works <\/a> <\/h2>\n