Help Center User GuideGetting StartedFAQRelease Notes
User Guide
Getting Started
Release Notes

Creating SSL Forward Proxy Profiles

Use the SSL Forward Proxy Profile page to view and manage SSL proxy profile details. SSL proxy is enabled as an application service within a security policy. You specify the traffic that you want the SSL proxy enabled on as match criteria and then specify the SSL proxy profile to be applied to the traffic.

Before You Begin

Configuring SSL Forward Proxy Profile Settings


To create an SSL forward proxy profile:

  1. Select Configure > Application Firewall Policy > SSL Forward Proxy Profiles.
  2. Click Create.
  3. Complete the configuration according to the guidelines provided in Table 123.
  4. Click OK.

An SSL forward proxy profile is created that can be assigned to a firewall policy for advanced security options.

Note: If none of the services (AppFW, IDP, or AppTrack) are configured, then SSL proxy services are bypassed even if an SSL proxy profile is attached to a firewall policy.

Table 123: SSL Forward Proxy Profile Settings



General Information


Enter a unique string of alphanumeric characters, colons, periods, dashes, and underscores. No spaces are allowed; maximum length is 63 characters.


Enter a description for the SSL forward proxy profile; maximum length is 1024 characters.

Preferred Cipher

Select a preferred cipher. Ciphers are divided into the following categories depending on their key strength.

  • Custom—Configure custom cipher suite and order of preference.
  • Medium—Use ciphers with key strength of 128 bits or greater.
  • Strong—Use ciphers with key strength of 168 bits or greater.
  • Weak—Use ciphers with key strength of 40 bits or greater.

Custom Ciphers

Select custom ciphers from the list.

Flow Trace

Select this option to enable flow trace for troubleshooting policy-related issues.

Root Certificate

Select or add a root certificate. In a public key infrastructure (PKI) hierarchy, the root CA is at the top of the trust path. The root CA identifies the server certificate as a trusted certificate.

Click Add for a new root certificate. On the Add page, select a device and the trusted CAs to associate to the root certificate.

Exempted Address

Select addresses to create whitelists that bypass SSL forward proxy processing.

Because SSL encryption and decryption are complicated and expensive procedures, network administrators can selectively bypass SSL proxy processing for some sessions. Such sessions mostly include connections and transactions with trusted servers or domains with which network administrators are very familiar. There are also legal requirements to exempt financial and banking sites. Such exemptions are achieved by configuring the IP addresses or domain names of the servers under whitelists.

Exempted URL Categories

Select URL categories to create whitelists that bypass SSL forward proxy processing.

These URL categories are exempted during SSL inspection. Only the predefined URL categories can be selected for the exemption.


Server Authentication Failure

Select this option to ignore server authentication completely.

In this case, SSL forward proxy ignores errors encountered during the server certificate verification process (such as CA signature verification failure, self-signed certificates, and certificate expiry).

We do not recommend this option for authentication, because configuring it results in websites not being authenticated at all. However, you can use this option to effectively identify the root cause for dropped SSL sessions.

Session Resumption

Select the Disable Session Resumption option if you do not want session resumption.

To improve throughput and still maintain an appropriate level of security, SSL session resumption provides a session caching mechanism so that session information, such as the pre-master secret key and agreed-upon ciphers, can be cached for both the client and server.


Select this option to generate logs. You can choose to log all events, warnings, general information, errors, or different sessions (whitelisted, allowed, dropped, or ignored).


After a session is created and SSL tunnel transport has been established, a change in SSL parameters requires renegotiation. SSL forward proxy supports both secure (RFC 5746) and nonsecure (TLS v1.0 and SSL v3) renegotiation.

Select one of the following options if a change in SSL parameters requires renegotiation:

  • None (selected by default)
  • Allow
  • Allow-secure
  • Drop

When session resumption is enabled, session renegotiation is useful in the following situations:

  • Cipher keys need to be refreshed after a prolonged SSL session.
  • Stronger ciphers need to be applied for a more secure connection.

Related Documentation

Help us to improve. Rate this article.
Feedback Received. Thank You!

Ask questions in TechWiki

Check documentation in TechLibrary

Rating by you:      

Additional Comments

800 characters remaining

May we contact you if necessary?


Need product assistance? Contact Juniper Support