Intermediate network entity

An apparatus comprising:

• at least one processor;
• and at least one memory including computer program code;
• the at least one memory and the computer program code being configured to, with the at least one processor, cause the apparatus at least to perform a method of controlling secure communications in a communications network comprising a client, one or more servers and an intermediate network element between the client and the one or more servers, the method comprising:
• receiving, at the intermediate network element (INE), a request from the client to establish a secure connection between the client and a first server;
• analyzing the received request to determine a client identifier identifying the client to the INE;
• determining based at least on the determined client identifier the client uses certificate pinning, in which the client has stored preconfigured data about server certificates of the servers, wherein the client verifies that a server certificate is received from the corresponding server by use of the stored preconfigured certificate data of the servers;
• responsive to a determination that the client uses certificate pinning, forwarding by the INE, the received request on to the first or a second server;
• and
• responsive to a determination that the client does not use certificate pinning, sending to the client, in response to the received request, a first message comprising information for the client to use in establishing a secure connection with the INE, the information including an INE certificate associated with the INE;
• responsive to a determination that the client accepts the first message:
• establishing a first end-to-end secure connection between the INE and the client using the INE certificate;
• and
• establishing a second end to end secure connection between the INE and the first or second server.

A non-transitory computer readable storage medium comprising a set of computer readable instructions stored thereon, which, when executed by a processing system, cause the system to implement a method of controlling secure communications in a communications network comprising a client, one or more servers and an intermediate network element between the client and the one or more servers, the method comprising:

• receiving, at the intermediate network element (NE), a request from the client to establish a secure connection between the client and a first server;
• analyzing the received request to determine a client identifier identifying the client to the INE;
• determining based at least on the determined client identifier whether the client uses certificate pinning, in which the client has stored preconfigured data about server certificates of the servers, wherein the client verifies that a server certificate is received from the corresponding server by use of the stored preconfigured certificate data of the servers;
• responsive to a determination that the client uses certificate pinning, forwarding by the INE, the received request on to the first or a second server;
• and
• responsive to a determination that the client does not use certificate pinning, sending to the client, in response to the received request, a first message comprising information for the client to use in establishing a secure connection with the INE, the information including an INE certificate associated with the INE;
• responsive to a determination that the client accepts the first message:
• establishing a first end-to-end secure connection between the INE and the client using the INE certificate;
• and
• establishing a second end to end secure connection between the INE and the first or second server.