Proactive transport layer security identity verification

A system comprising:

• a processor;
• and
• a non-transitory, computer-readable storage medium embodying instructions executable by the processor for:
• responsive to communication of a client handshake from a client to a server for establishing encrypted communications between the client and the server:
• holding open, by an intermediate verification system interfaced between the server and the client, the client handshake;
• and
• opening a connection between the intermediate verification system and the server via which the intermediate verification system issues a server verification handshake to the server;
• responsive to issuance of the server verification handshake to the server, receiving a server certificate associated with the server by the intermediate verification system;
• responsive to receipt of the server certificate, processing, by the intermediate verification system, the server certificate to determine an identity of the server and a geographical area associated with the server;
• and
• rendering, by the intermediate verification system, a security policy decision regarding traffic between the server and the client based on the identity;
• wherein the security policy decision includes determining, based on a legal or regulatory requirement associated with the geographical area and associated with the traffic between the server and the client, whether or not to decrypt the traffic between the server and the client for further inspection, wherein the determining whether or not to decrypt the traffic is further based on the server certificate, such that the decryption is prevented when the server certificate is indicative of a type of traffic for which decryption is prohibited by the legal or regulatory requirement within the geographical area.

A non-transitory, computer-readable storage medium embodying computer executable instructions configured for:

• responsive to communication of a client handshake from a client to a server for establishing encrypted communications between the client and the server:
• holding open, by an intermediate verification system interfaced between the server and the client, the client handshake;
• and
• opening a connection between the intermediate verification system and the server via which the intermediate verification system issues a server verification handshake to the server;
• responsive to issuance of the server verification handshake to the server, receiving a server certificate associated with the server by the intermediate verification system;
• responsive to receipt of the server certificate, processing, by the intermediate verification system, the server certificate to determine an identity of the server and a geographical area associated with the server;
• and
• rendering, by the intermediate verification system, a security policy decision regarding traffic between the server and the client based on the identity;
• wherein the security policy decision includes determining, based on a legal or regulatory requirement associated with the geographical area and associated with the traffic between the server and the client, whether or not to decrypt the traffic between the server and the client for further inspection, wherein the determining whether or not to decrypt the traffic is further based on the server certificate, such that the decryption is prevented when the server certificate is indicative of a type of traffic for which decryption is prohibited by the legal or regulatory requirement within the geographical area.