Re: [pkix] How do we differentiate authentic servers from proxies performing TLS interception?

["Miller, Timothy J." <[e-mail]>]

>         One good reason for a separate EKU value for proxies might be to let the client invoke a different name matching algorithm, although I see no case for changing KeyUsage bits here.  It is reasonable for a client inside a proxied network to configure a single proxy name + issuer chain that will be accepted in advance.

You'd only need alternative name matching if the proxy actually substitutes its own certificate.  Alternatively the proxy acts as a CA and signs a new certificate on the fly--though they don't typically generate a key--containing the origin server's name and some other specific details from the origin server's certificate.  Implementations I'm familiar with can do either, but usually are deployed as a CA to avoid name matching problems.  

No certificate marking is needed, though.  Clients could invoke alternative certificate processing when a certificate name match fails but the certificate chains to a trust anchor marked as "trusted for proxy."  

-- T