WSL and SSL decryption

[MD-OTL]

Hi guys. We have a number of developers that use Windows Subsystem for Linux (WSL) on their Windows clients, and there are a lot of URLs and services that will not work when we decrypt the traffic. Managing a decryption exclude list for them would be a major pain, so I am thinking of ways to fix this. Is there any way to separate WSL sessions from Windows sessions somehow? How do others handle problems like this?

[BPry]

@MD-OTL,

In a default WSL install it simply sends traffic out the connected interface, so there's nothing to identify and separate out WSL traffic from the client traffic itself. WSL can be treated just like any other Linux client though, so I would simply make them install the certificate that you're using on your firewall so you can decrypt the traffic appropriately. Then the only exceptions that you're making are the same that you'd be making for any Linux endpoints already in your network.

We do this two different ways:

1) If you are smart enough to manage your own WSL instance (and you're a member of a group that actually allows you to install it) than go for it. We aren't making any special exceptions for your WSL instance that wouldn't need to be made otherwise.

2) If you aren't technically inclined enough to setup WSL to meet our requirements (but you are a member of a group that is approved to use WSL) we'll spin you up a managed Linux server for you to use were we directly manage it and it'll already work within the environment. 

[MD-OTL]

@BPry , many thanks for your answer. Unfortunately many of our developer services use client certificates or certificate pinning and are therefore undecryptable. And it seems like our developers change tools and libraries as often as we change underwear. To maintain a do-not-decrypt list would cause frustration for them and a lot of hassle for us. I was hoping WSL maybe had the same option as VMware Workstation, that you can have different IP address for the virtual NIC of WSL and the physical NIC of the Windows client. I will look into it.