Secure web gateway visibility into certificate-pinned applications

A non-transitory computer readable medium including program instructions that, when executed on a processor coupled to a session, cause the processor to implement a method of security monitoring of and generating alerts during a Transport Layer Security (“TLS”) or other pinned certificate session, the method including:

• on a client device, using an endpoint routing client to securely tunnel sessions via a public network, through a secure web gateway hosted on a cloud, to cloud-based resources hosted by a third party provider;
• for a new session with a cloud-based resource that uses a pinned certificate, detecting initiation of the new session and sending a request to a key extractor running on the client device to perform a key extraction for one or more keys being used in the new session;
• the secure web gateway buffering encrypted packets and bi-directionally forwarding the encrypted packets between the client device and the cloud-based resource;
• receiving the one or more extracted keys, applying the extracted keys to session traffic in the buffer, and decrypting data portions of the buffered packets;
• while continuing to forward the encrypted packets, further applying the extracted keys to decrypt ongoing session traffic after processing the buffered packets;
• detecting from review of the decrypted data portions a security condition that requires alerting an administrator;
• and
• the secure web gateway raising an alert to the administrator.

A system including a processor and memory coupled to a session, the memory loaded with program instructions that, when executed on the processor, cause the processor to implement a method of security monitoring of and generating alerts during a Transport Layer Security (“TLS”) or other pinned certificate session, the method including:

• on a client device, using an endpoint routing client to securely tunnel sessions via a public network, through a secure web gateway hosted on a cloud, to cloud-based resources hosted by a third party provider;
• for a new session with a cloud-based resource that uses a pinned certificate, detecting initiation of the new session and sending a request to a key extractor running on the client device to perform a key extraction for one or more keys being used in the new session;
• the secure web gateway buffering encrypted packets and bi-directionally forwarding the encrypted packets between the client device and the cloud-based resource;
• receiving the one or more extracted keys, applying the extracted keys to session traffic in the buffer, and decrypting data portions of the buffered packets;
• while continuing to forward the encrypted packets, further applying the extracted keys to decrypt ongoing session traffic after processing the buffered packets;
• detecting from review of the decrypted data portions a security condition that requires alerting an administrator;
• and
• the secure web gateway raising an alert to the administrator.