Help Center User GuideGetting StartedFAQ
 
X
User Guide
Getting Started
FAQ
Contents  

SSL Forward Proxy Overview

Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet. SSL, also called Transport Layer Security (TLS), ensures the secure transmission of data between a client and a server through a combination of privacy, authentication, confidentiality, and data integrity. SSL relies on certificates and private–public key exchange pairs for this level of security.

Server authentication guards against fraudulent transmissions by enabling a Web browser to validate the identity of a Web server. Confidentiality mechanisms ensure that communications are private. SSL enforces confidentiality by encrypting data to prevent unauthorized users from eavesdropping on electronic communications. Finally, message integrity ensures that the contents of a communication have not been tampered with.

SSL forward proxy is a transparent proxy; that is, it performs SSL encryption and decryption between the client and the server, but neither the server nor the client can detect its presence. SSL forward proxy ensures that it has the keys to encrypt and decrypt the payload:

Figure 3 shows how SSL forward proxy works on an encrypted payload. When application firewall (AppFW) is configured, SSL forward proxy acts as an SSL server terminating the SSL session from the client and a new SSL session is established to the server. The device decrypts and then re-encrypts all SSL forward proxy traffic. SSL forward proxy uses the following services:

Figure 3: SSL Forward Proxy on an Encrypted Payload

SSL Forward
Proxy on an Encrypted Payload

This topic has the following sections:

Supported Ciphers in Proxy Mode

An SSL cipher comprises encryption ciphers, authentication method, and compression. Table 139 displays a list of supported ciphers. NULL ciphers are excluded.

The following SSL protocols are supported:

Table 139: Supported Ciphers in Proxy Mode

SSL Cipher

Key Exchange Algorithm

Data Encryption

Message Integrity

RSA_WITH_RC4_128_MD5

RSA key exchange

128-bit RC4

Message Digest 5 (MD5) hash

RSA_WITH_RC4_128_SHA

RSA key exchange

128-bit RC4

Secure Hash Algorithm (SHA) hash

RSA_WITH_DES_CBC_SHA

RSA key exchange

DES CBC

SHA hash

RSA_WITH_3DES_EDE_CBC_SHA

RSA key exchange

3DES EDE/CBC

SHA hash

RSA_WITH_AES_128_CBC_SHA

RSA key exchange

128-bit AES/CBC

SHA hash

RSA_WITH_AES_256_CBC_SHA

RSA key exchange

256-bit AES/CBC

SHA hash

RSA_EXPORT_WITH_RC4_40_MD5

RSA-export

40-bit RC4

MD5 hash

RSA_EXPORT_WITH_DES40_CBC_SHA

RSA-export

40-bit DES/CBC

SHA hash

RSA_EXPORT1024_WITH_DES_CBC_SHA

RSA 1024 bit export

DES/CBC

SHA hash

RSA_EXPORT1024_WITH_RC4_56_MD5

RSA 1024 bit export

56-bit RC4

MD5 hash

RSA_EXPORT1024_WITH_RC4_56_SHA

RSA 1024 bit export

56-bit RC4

SHA hash

RSA-WITH-AES-256-GCM-SHA384

RSA key exchange

256-bit AES/GCM

SHA384 hash

RSA-WITH-AES-256-CBC-SHA256

RSA key exchange

256-bit AES/CBC

SHA256 hash

RSA-WITH-AES-128-GCM-SHA256

RSA key exchange

128-bit AES/GCM

SHA256 hash

RSA-WITH-AES-128-CBC-SHA256

RSA key exchange

128-bit AES/CBC

SHA256 hash

Server Authentication

Implicit trust between the client and the device (because the client accepts the certificate generated by the device) is an important aspect of SSL proxy. It is extremely important that server authentication is not compromised; however, in reality, self-signed certificates and certificates with anomalies are in abundance. Anomalies can include expired certificates, instances of common name not matching a domain name, and so forth.

You can specify that the SSL forward proxy should ignore server authentication completely. In this case, SSL forward proxy ignores errors encountered during the server certificate verification process (such as CA signature verification failure, self-signed certificates, and certificate expiry).

You can specify whether the SSL proxy should ignore server authentication errors or not during the creation of an SSL forward proxy profile.

Root CA

In a public key infrastructure (PKI) hierarchy, the root CA is at the top of the trust path. The root CA identifies the server certificate as a trusted certificate.

Trusted CA List

SSL forward proxy ensures secure transmission of data between a client and a server. Before establishing a secure connection, SSL forward proxy checks certificate authority (CA) certificates to verify signatures on server certificates. For this reason, a reasonable list of trusted CA certificates is required to effectively authenticate servers.


Session Resumption

An SSL session refers to the set of parameters and encryption keys that are created when a full handshake is performed. A connection is the conversation or active data transfer that occurs within the session. The computational overhead of a complete SSL handshake and generation of master keys is considerable. In short-lived sessions, the time taken for the SSL handshake can be more than the time for data transfer. To improve throughput and still maintain an appropriate level of security, SSL session resumption provides a mechanism for caching sessions so that session information, such as the pre-master secret key and agreed-upon ciphers, can be cached for both the client and the server. The cached information is identified by a session ID. In subsequent connections, both parties agree to use the session ID to retrieve the information rather than create a new pre-master secret key. Session resumption shortens the handshake process and accelerates SSL transactions.

SSL Proxy Logs


When logging is enabled in an SSL proxy profile, the SSL proxy can generate the messages shown in Table 140.

Table 140: SSL Proxy Logs

Log Type

Description

SSL_PROXY_SSL_SESSION_DROP

Logs generated when a session is dropped by SSL proxy.

SSL_PROXY_SSL_SESSION_ALLOW

Logs generated when a session is processed by SSL proxy even after encountering some minor errors.

SSL_PROXY_SESSION_IGNORE

Logs generated if non-SSL sessions are initially mistaken as SSL sessions.

SSL_PROXY_SESSION_WHITELIST

Logs generated when a session is allowed.

SSL_PROXY_ERROR

Logs used for reporting errors.

SSL_PROXY_WARNING

Logs used for reporting warnings.

SSL_PROXY_INFO

Logs used for reporting general information.

All logs contain similar information; the message field contains the reason for the log generation. One of three prefixes shown in Table 141 identifies the source of the message. Other fields are descriptively labeled.

Table 141: SSL Proxy Log Prefixes

Prefix

Description

system

Logs generated because of errors related to the device or an action taken as part of the SSL proxy profile. Most logs fall into this category.

openssl error

Logs generated during the handshake process if an error is detected by the openssl library.

certificate error

Logs generated during the handshake process if an error is detected in the certificate (X.509 related errors).

Related Documentation

Ask questions in TechWiki

Check documentation in TechLibrary

Rating by you:      
X

Additional Comments

800 characters remaining

May we contact you if necessary?

Name:
Email:

Need product assistance? Contact Juniper Support

Submit