6

Provided I have not set cache-control header to private, can ISPs cache web pages (by respecting max-age) served over HTTPS?

Sorry if I sound naive, but I wanted to know if ISPs somehow can cache and relay without intercepting/decrypting.

1
  • 9
    ISPs are not the only thing you need to worry about, caching can also take place in the CDN level and the browser level. – Stephen Ostermiller May 28 at 17:32
17

If they provide an HTTP proxy service you use, they can cache on the fly.

If they do not pervert the HTTPS stream (which starts by changing the server certificate exposed and/or changing the CAs you trust on your client device) they have no way to see the content, hence they have nothing to cache.

7

SSL/TLS is a transport encryption standard. It hides the entire communication between client and server. So decryption of the transport encryption* is a prerequisite to caching.

Intercepting SSL/TLS is something that does happen, but mostly on private networks or by ISPs in totalitarian regimes. It's not something that can really be done without users noticing as users will have to install a special root certificate on the client devices.

Another thing that increasingly happens for media content is that site owners partner with CDNs and those CDNs in turn place distribution servers into ISP networks. Since this happens with the approval and cooperation of the site operator, legitimate certificates can be presented.

* Of course there may be other layers of encryption, for example a TV stream may be encrypted by the DRM system, then encrypted again by the transport encryption.

5
  • Your answer is mainly correct, except the first statement. The domain name of the website is not hidden in the initial communication - which is required for name based ssl hosting which is ubiquitous. – davidgo May 29 at 7:55
  • "It's not something that can really be done without users noticing" – Slight nitpick: I think it would by slightly more correct to say "It's not something that can really be done without administrators noticing". In the home context, user and administrator are the same, but in corporate contexts, user and administrator are different, which is precisely why it is possible to install MitM root certificates without cooperation of the user. – Jörg W Mittag May 29 at 15:35
  • @davidgo Actually, it depends. There's a protocol extension (iirc) that hides it, however it's not very common (and can cause your traffic to be dropped). – wizzwizz4 May 29 at 16:51
  • 1
    @davidgo "The domain name of the website is not hidden in the initial communication - which is required for name based ssl hosting which is ubiquitous. " That is soon about to change with ECH (previously ESNI), even the SNI information in the TLS first steps will be encrypted. – Patrick Mevzek May 29 at 19:08
  • 1
    @wizzwizz4 "however it's not very common (and can cause your traffic to be dropped). " It is for TLS 1.3 and indeed some countries already said they will filter it. It is not yet common because it is not fully standardized yet, and it needs the proper DNS HTTPS / SVCB records that are being worked on right now. – Patrick Mevzek May 29 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.