Web proxy and TLS 1.3

Question

Hi, 
 is there plan to support TLS 1.3 in Web proxy (port 3128 configured in browser)? 
 Now running 18.5 MR1 and when the web server supports only TLS 1.3 then the connection fails over web proxy. 
 Thanks for info.

Michael Dunn · Accepted Answer

LuCar and I are both from Sophos. I can confirm that: The web proxy, whether running in standard or transparent mode, supports up to TLS 1.2 for decryption. This applies to both the Client->XG connection and the XG->Web server connection. If you are not decrypting traffic, it support TLS 1.3. That effectively means if you are not decrypting traffic then you are fine. However if you are decrypting traffic and you are using a browser that only support tls 1.3 or going to a website that only supports tls 1.3 you will be blocked. 
 In practical terms, client->XG communication is internal to your network and high security is not as important. The XG->web server communication would be improved with TLS 1.3, however pretty much all web servers that support TLS 1.3 also support 1.2 (in fact it is hard to find a test server like that) and ssllabs.com lowers the score for any tls 1.3 only servers. 
 DPI mode, running in transparent mode, fully supports TLS 1.3 and has a lot more fine tuning of TLS support.

LuCar Toni · Answer

This is not possible. TLS1.3 cannot be scanned via a legacy proxy. You need a DPI engine.

LuCar Toni · Answer

And you cant inspect traffic, which is a 3128 via TLS1.3. Thats the point. TLS1.3 requires a stream based decryption.

Michael Dunn · Answer

The standard web proxy will continue for years and new features are being added. However new feature development priorities are balanced between customer needs, security, the internet landscape, acceptable workarounds, etc. Implementing TLS 1.3 on the web proxy will mean that some other feature won't be done instead. Right now I don't think that TLS 1.3 is a high enough priority that it is in any particular roadmap. So please continue to rely on the standard mode proxy, but don't expect TLS 1.3 support to be added in the foreseeable future.

Web proxy and TLS 1.3

Top Replies