agent's TLS fingerprint check failed behind the corporate proxy

agent's TLS fingerprint check failed behind the corporate proxy

TL;DR

Corporate proxies that do TLS inspection terminate the connection and re-encrypt with their own certificate, so the fingerprint the agent sees is the proxy's, not the origin's. Check whether a proxy is in the path by reading the issuer in the presented chain, then either record the proxy's fingerprint as the expected value for that network or run the check from a host outside inspection.

agent's TLS fingerprint check failed behind the corporate proxy

Use this when

• A TLS fingerprint check passes everywhere except the corporate network
• The check fails on the office VPN or Zscaler-style egress but passes on a hotspot
• Certificate pinning breaks for agents behind the proxy
• JA3 or certificate fingerprints mismatch only from certain runners

Not for this skill when

• The mismatch appears on an untrusted network (that is a possible real MITM, investigate as an incident)
• You are choosing a fingerprinting method
• You are choosing a proxy product

Steps

1. Inspect the presented certificate chain and read the issuer. If the issuer is the corporate CA instead of the site's public CA, you are fingerprinting the proxy.

   openssl s_client -connect example.com:443 -servername example.com -showcerts

   Expected: the issuer names the proxy CA (proxy in path) or the public CA (no proxy).

2. Check for proxy environment variables on the runner (HTTPPROXY, HTTPSPROXY and their lowercase forms). Expected: you know whether the runner is configured to use the proxy.

3. Decide per check: for checks that must see the origin, run them from a host outside TLS inspection; for checks that just need consistency, record the proxy's fingerprint as the expected value for that network path. Expected: a documented expected fingerprint per network path, not one global value.

4. Re-run the check with the right expectation for the path it runs on. Expected: the fingerprint matches.

Variant: JA3 fingerprint mismatch behind proxy

JA3 fingerprints the TLS client hello as seen by the server side, and the proxy re-originates it. Same fix: expect the proxy's JA3 on proxied paths, the client's JA3 on direct paths.

Variant: TLS fingerprint check fails on Zscaler network

Zscaler inspects by policy per destination; some hosts are inspected and some are not. Check per-host rather than assuming the whole network behaves one way.

Variant: certificate pinning broken by TLS inspection

Pinning the origin cert cannot work through an inspecting proxy by design. Pin the proxy CA for that network path, or exempt the check host from inspection through the approved process.

Why this happens

TLS-inspecting proxies break the end-to-end TLS session on purpose: they decrypt, inspect, and re-encrypt. Any fingerprint of the session, certificate, or handshake necessarily fingerprints the proxy, not the origin. The check is working; its expectation is wrong for that network.

Edge cases and pitfalls

• Inspection policies differ per destination; one host can be inspected while another on the same network is not.
• VPN, office, and cloud-runner paths each have their own fingerprint; document all of them.
• Do not disable inspection to make the check pass; change the expectation, not the security control.
• Proxies rotate their certificates; a pinned proxy fingerprint needs the same rotation tracking as any other pin.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ByeVZv7GFhL6x6gosaOKKw