<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-tls-interception
description: >-
  Detect man-in-the-middle TLS interception by corporate proxies, malware,
  or nation-state actors. Covers JA3/JA3S fingerprinting, certificate
  transparency log monitoring, trust store anomaly detection, and TLS proxy
  identification for incident response and privacy assessments.
domain: cybersecurity
subdomain: cryptography
tags:
  - tls
  - mitm
  - interception
  - ja3
  - certificate-transparency
  - proxy-detection
  - ssl-inspection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557.002"]
---

# Detecting TLS Interception

## Overview

TLS interception (SSL inspection / MITM proxying) replaces the legitimate
server certificate with one signed by a local CA. Corporate proxies, malware,
and surveillance tools use this technique. Detection involves fingerprinting
TLS handshake parameters, analyzing certificate chains for unexpected issuers,
and monitoring Certificate Transparency logs for unauthorized issuance.

## Prerequisites

| Requirement | Install |
|---|---|
| OpenSSL 3.x | `apt install openssl` |
| nmap + ssl scripts | `apt install nmap` |
| Python 3.10+ | For agent tooling |
| tshark / Wireshark | `apt install wireshark-cli` |

## Key Concepts

### Certificate Chain Anomaly Detection

```bash
# Check if the issuer is a known public CA or a corporate CA
openssl s_client -connect example.com:443 < /dev/null 2>/dev/null | \
  openssl x509 -noout -issuer -subject

# Compare certificate fingerprint against known-good value
openssl s_client -connect example.com:443 < /dev/null 2>/dev/null | \
  openssl x509 -noout -fingerprint -sha256

# Check for non-standard root CAs in the system trust store
awk -v cmd='openssl x509 -noout -subject -issuer' \
  '/BEGIN/{close(cmd)};{print | cmd}' /etc/ssl/certs/ca-certificates.crt

# Detect short-lived interception certificates
openssl s_client -connect example.com:443 < /dev/null 2>/dev/null | \
  openssl x509 -noout -dates -issuer | head -5
```

### JA3 / JA3S Fingerprinting

```bash
# Capture TLS Client Hello with tshark for JA3 extraction
tshark -i eth0 -Y 'tls.handshake.type == 1' -T fields \
  -e ip.src -e tls.handshake.ja3 -c 50

# Capture TLS Server Hello for JA3S
tshark -i eth0 -Y 'tls.handshake.type == 2' -T fields \
  -e ip.dst -e tls.handshake.ja3s -c 50

# Compare JA3 against known TLS proxy fingerprints
tshark -r capture.pcap -Y 'tls.handshake.type == 1' -T fields \
  -e ip.src -e tls.handshake.ja3 | sort | uniq -c | sort -rn
```

### Certificate Transparency Log Monitoring

```bash
# Query CT logs for certificates issued for your domain
curl -s "https://crt.sh/?q=%.example.com&output=json" | \
  python3 -m json.tool | head -80

# Check for unexpected issuers in CT logs
curl -s "https://crt.sh/?q=example.com&output=json" | \
  python3 -c "
import sys, json
data = json.load(sys.stdin)
for c in data:
    print(c.get('issuer_name', 'unknown'))
" | sort | uniq -c | sort -rn
```

### TLS Proxy Detection via Nmap

```bash
# Scan for TLS version and cipher suite anomalies
nmap --script ssl-enum-ciphers -p 443 example.com

# Detect known interception product signatures
nmap --script ssl-cert -p 443 example.com 2>/dev/null | \
  grep -iE "bluecoat|fortigate|paloalto|zscaler|symantec"
```

## Common Failures

| Failure | Cause | Fix |
|---|---|---|
| Corporate proxy undetected | Proxy CA trusted in system store | Audit trust store for non-public roots |
| JA3 hash mismatch | Browser version changed fingerprint | Maintain versioned JA3 baseline |
| CT log gaps | Not all CAs log to monitored logs | Monitor multiple CT log sources |
| False positive on CDN certs | CDN uses own CA infrastructure | Whitelist known CDN issuer fingerprints |

## Workflow

1. **Baseline** — Record expected certificate fingerprints and JA3 hashes
2. **Monitor** — Continuous CT log and certificate chain monitoring
3. **Detect** — Flag chain anomalies, unexpected issuers, JA3 deviations
4. **Analyze** — Determine if interception is authorized or malicious
5. **Report** — Document findings with evidence and risk assessment
6. **Remediate** — Remove unauthorized CAs, alert on active interception

## Verification

| Check | Method |
|---|---|
| No rogue CAs in trust store | All root CAs match organizational baseline |
| JA3 fingerprints match | Client hello matches expected browser profile |
| CT logs clean | No unauthorized certs in Certificate Transparency |
| Certificate chain valid | Leaf cert chains to expected public CA |
| No interception detected | All checks pass from multiple vantage points |

## References

- [JA3 — TLS Client Fingerprinting](https://github.com/salesforce/ja3)
- [Certificate Transparency RFC 6962](https://datatracker.ietf.org/doc/html/rfc6962)
- [crt.sh — CT Log Search](https://crt.sh/)
- [NIST SP 800-52 Rev. 2 — TLS Guidelines](https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final)
