Configuring and Deploying an SSL Forward Proxy Policy
The following is the workflow for configuring and deploying
an intent-based SSL forward proxy policy in CSO:
Procedure
- Obtain the root
certificate and private key from your trusted certificate authority
(CA).
- Combine the root certificate and private key into a single
file.
- Import the certificate
and private key file (on the Import Certificate page); see Importing a Certificate.
- (Optional)
Install the imported certificate on one or more sites (on the Install
Certificate page); see Installing and Uninstalling Certificates.
- By default, Juniper Networks ships trusted certificates
for sites that use HTTPS. These certificates are installed automatically
by CSO when the site is successfully provisioned.
If you want to use additional trusted certificates, import and
install the certificates as explained in Step 3 and 4.
- Create an SSL proxy profile (on the Create SSL Proxy Profiles)
page; see Creating SSL Forward Proxy Profiles.
Note
Use the imported root certificate when you create the
SSL proxy profile.
For trusted certificates, specify that all trusted certificates
on the device are used (select All in the Trusted
Certificate Authorities field).
- Create an SSL proxy policy intent that uses the SSL proxy
profile that you created (on the SSL Proxy Policy page); see Creating SSL Proxy Policy Intents.
- Deploy the SSL proxy policy; see Deploying Policies.
Note
Ensure that the root and trusted certificates are imported
into CSO before the policy is deployed.
If you have not installed the certificates referenced
in the SSL proxy profile, then they are automatically installed when
the SSL proxy policy is deployed.
- For Internet access from an SRX Series device by using
the SSL proxy, ensure that you import the root certificate (obtained
in Step 1)
into the browsers of the clients accessing the Internet.
Note If you do not import the certificate, the traffic does
not go through for clients in the LAN segments.
Related Documentation
Help us to improve. Rate this article.
Feedback Received. Thank You!