Can Client DPI-SSL ever generate Man-In-The-Middle (MITM) errors with sites that check for MITM attacks? (Example: Certificate Pinning)

03/26/2020 13 12538

DESCRIPTION:
Does Client DPI-SSL ever generate Man-In-The-Middle (MITM) errors with sites that might check for MITM attacks?

RESOLUTION:

DPI-SSL is technically a sanctioned Man-In-The-Middle attack.  Any software designed to detect MITM attacks would recognize DPI-SSL as an attack, despite being sanctioned by the network administrator.

Note:  Some websites and apps will not allow you to talk to the desired server if the serial number of the certificate doesn't match what is stored on your local client (called Certificate Pinning).  This is an anti-MITM measure.  Because Client DPI-SSL presents the client with the certificate stored on the SonicWall (not the certificate on the server), and because a serial number for a server certificate cannot be spoofed, the only workaround for this is to bypass the site in Client DPI-SSL.