Configure and Deploy SSL Proxy Policy in CSO

Certificate Name

Enter the certificate name, which must be a unique string of alphanumeric characters and some special characters (_ -). No spaces are allowed and the maximum length is 32 characters.

Certificate Type

Select an option to specify whether the certificate that you are importing is a root certificate (Root CA) or a trusted certificate (Trusted CA).

Passphrase

Enter the passphrase to protect the private key or key pair of the Privacy-Enhanced Mail (PEM) certificate file.

Description

Enter a description for the certificate.

Certificate Content

Select whether you want to import the certificate content from a file or if you want to paste the certificate content.

File Path for Certificate

To import the certificate content from a file, click Browse. In the File Upload dialog that appears, select the certificate file and click Open.

The filename of the file that you uploaded is displayed.

Paste Certificate Content

To paste the certificate content directly from a file, open the certificate file in a text editor, copy the certificate content, and paste it in the text box.

General Information

Name

Enter a unique name for the profile, which can contain alphanumeric characters, hyphens, and underscores. No spaces are allowed and the maximum length is 63 characters.

Description

Enter a description for the profile. The maximum length is 255 characters.

Preferred Cipher

Select a preferred cipher, which enables you to define an SSL cipher that can be used with acceptable key strength:

• None (Default)—Do not specify a preferred cipher.

• Medium—Use ciphers with key strength of 128 bits or greater.

• Strong—Use ciphers with key strength of 168 bits or greater.

• Weak—Use ciphers with key strength of 40 bits or greater.

• Custom—Configure a custom cipher suite.

Custom Ciphers

If you specified a custom preferred cipher, you can define a custom cipher list by selecting one or more ciphers that the SSH server can use to perform encryption and decryption functions:

• None—No encryption.

• rsa-with-RC4-128-md5—RSA, 128- bit RC4, MD5 hash

• rsa-with-RC4-128-sha—RSA, 128-bit RC4, SHA hash

• rsa-with-des-cbc-sha—RSA, DES/CBC, SHA hash

• rsa-with-3DES-ede-cbc-sha—RSA, 3DES EDE/CBC, SHA hash

• rsa-with-aes-128-cbc-sha—RSA, 128-bit AES/CBC, SHA hash

• rsa-with-aes-256-cbc-sha—RSA, 256 bit AES/CBC, SHA hash

• rsa-export-with-rc4-40-md5—RSA-export, 40 bit RC4, MD5 hash

• rsa-export-with-des40-cbc-sha—RSA-export, 40 bit DES/CBC, SHA hash

• rsa-export1024-with-des-cbc-sha—RSA 1024 bit export, DES/CBC, SHA hash

• rsa-export1024-with-rc4-56-md5—RSA 1024 bit export, 56 bit RC4, MD5 hash

• rsa-export1024-with-rc4-56-sha—RSA 1024 bit export, 56 bit RC4, SHA hash

• rsa-with-aes-256-gcm-sha384—RSA, 256 bit AES/GCM, SHA384 hash

• rsa-with-aes-256-cbc-sha256—RSA, 256 bit AES/CBC, SHA256 hash

• rsa-with-aes-128-gcm-sha256—RSA, 128 bit AES/GCM, SHA256 hash

• rsa-with-aes-128-cbc-sha256—RSA, 256 bit AES/CBC, SHA256 hash

• ecdhe-rsa-with-aes-256-gcm-sha384—ECDHE, RSA, 256 bit AES/GCM, SHA384 hash

• ecdhe-rsa-with-aes-256-cbc-sha384—ECDHE, RSA, 256 bit AES/CBC, SHA384 hash

• ecdhe-rsa-with-aes-256-cbc-sha—ECDHE, RSA, 256 bit AES/CBC, SHA hash

• ecdhe-rsa-with-aes-3des-ede-cbc-sha—ECDHE, RSA, 3DES, EDE/CBC, SHA hash

• ecdhe-rsa-with-aes-128-gcm-sha256—ECDHE, RSA, 128 bit AES/GCM, SHA256 hash

• ecdhe-rsa-with-aes-128-cbc-sha256—ECDHE, RSA, 128 bit AES/CBC, SHA256 hash

• ecdhe-rsa-with-aes-128-cbc-sha—ECDHE, RSA, 128 bit AES/CBC, SHA hash

Flow Trace

Click the toggle button to enable flow tracing to enable the troubleshooting of policy-related issues. Flow tracing is disabled by default.

Root Certificate

Select a root certificate from the list or click Add Root Certificate to import a root certificate.

In a public key infrastructure (PKI) hierarchy, the root certificate authority (CA) is at the top of the trust path.

Trusted Certificate Authorities

Choose whether you want to add all trusted certificates present on the device (All) or select specific trusted certificates (Select Specific). Before establishing a secure connection, the SSL proxy checks CA certificates to verify signatures on server certificates.

If you chose to add selected trusted certificates, the existing trusted certificates are displayed. Select one or more certificates by clicking the check boxes, and click the > icon. The selected certificates are displayed in the column on the right.

Optionally, click Add Trusted Certificates to import a trusted certificate. See Import a Certificate.

Exempted Addresses

Exempted addresses include addresses that you want to exempt from undergoing SSL proxy processing.

To specify exempted addressees, select one or more addresses in the left column and click the > icon to confirm your selection. The selected addresses are then displayed in the right column. These addresses are used to create allow lists that bypass SSL forward proxy processing.

Because SSL encryption and decryption are complicated and expensive procedures, network administrators can selectively bypass SSL proxy processing for some sessions.

Such sessions typically include connections and transactions with trusted servers or domains with which network administrators are very familiar. There are also legal requirements to exempt financial and banking sites. Such exemptions are achieved by configuring the IP addresses or domain names of the servers under allow lists.

Exempted URL Categories

Select one or more previously defined URL categories in the left column and click the > icon to confirm your selection. The selected addresses are then displayed in the right column.

These URL categories are used to create allow lists that bypass SSL forward proxy processing. The selected URL categories are exempted during SSL inspection.

Actions

Server Auth Failure

Click the toggle button to enable CSO to ignore errors encountered during the server certificate verification process, such as CA signature verification failure, self-signed certificates, and certificate expiry. This toggle button is disabled by default, which means that server authentication errors are not ignored.

We do not recommend that you ignore authentication errors because it results in websites not being authenticated at all. However, you can use this option to effectively identify the root cause for dropped SSL sessions.

Session Resumption

Click the toggle button to enable session resumption. Session resumption is disabled by default.

To improve throughput and still maintain an appropriate level of security, SSL session resumption provides a session-caching mechanism so that session information, such as the pre-master secret key and agreed-upon ciphers, can be cached for both the client and server.

Logging

Select one or more events to be logged. You can choose to log all events, warnings, general information, errors, or different sessions (allowed, dropped, or ignored).

By default, no events are logged.

Renegotiation

Select one of the following options if a change in SSL parameters requires renegotiation:

• None—Renegotiation is not required. This is the default setting.

• Allow—Allow secure and nonsecure renegotiation.

• Allow Secure—Allow secure negotiation only.

• Drop—Drop session on renegotiation request.

After a session is created and SSL tunnel transport has been established, a change in SSL parameters requires renegotiation. SSL forward proxy supports both secure (RFC 5746) and nonsecure (TLS v1.0 and SSL v3) renegotiation.

When session resumption is enabled, session renegotiation is useful in the following situations:

• Cipher keys need to be refreshed after a prolonged SSL session.

• Stronger ciphers need to be applied for a more secure connection.

[Name]

Enter the name of the SSL proxy policy intent in the first text box. If you do not enter a name, the system-generated name is used. The name that you enter must begin with an alphanumeric character and can contain alphanumeric characters and some special characters (- _). The maximum length is 63 characters.

[Description]

Enter the description of the SSL proxy policy intent in the second text box.

Source

Select one or more of the following source endpoints:

• IP address or IP address group

• Site

• Site group

• Department

The default source for an SSL proxy policy intent is All Sites. If you don’t add a source, then the default is used.

Destination

Select one or more of the following destination endpoints:

• IP address or address group

• Site

• Site group

• Department

The default destination for an SSL proxy policy intent is Internet. If you don’t add a destination, then the default is used.

SSL Proxy Profile

Specify an SSL proxy profile to associate with the SSL proxy policy intent in one of the following ways:

• Click the add icon (+) and select the SSL proxy profile from the list of previously configured profiles.

• Filter the profiles by entering a search term in the SSL Proxy Profile field and select a profile.

• Add a SSL proxy profile—Click the Add New Profile link. See Add SSL Forward Proxy Profiles.

• Click the View more results link to view additional configured profiles. The list of SSL proxy profiles is displayed in the End Points panel on the right.

  To add a profile, select it and click the check mark icon (✓) that appears when you hover over the profile.