Distribute the re-signing certificate to all your non-domain computer users manually, or through the Certificate Portal.For instructions, see Manage Device Certificates (Web UI) or Manage Device Certificates (WSM). Use the Certificate Import Wizard to import the re-signing CA and root CA certificates to your Firebox.For instructions, see Sign a Certificate with Microsoft CA. Have the certificate signed by your Microsoft CA server.For instructions, see Create a Certificate CSR. Make sure you select Proxy Authority (re-signing CA certificate for outbound SSL/TLS content inspection) as the certificate function. Create a Certificate Signing Request (CSR) from Firebox System Manager.We recommend that you use a certificate signed by your own internal CA.įor example, if your organization uses Microsoft Active Directory Certificate Services, you can: When the client devices already trust your local PKI root CA certificate, you will not have to deploy another certificate to each client device. If your organization already has a Public Key Infrastructure (PKI) set up with a local CA, you can import a certificate that is signed by the internal CA to your Firebox. Local CA Certificate (Recommended Option) The Proxy Authority re-signing certificate can be either an imported CA certificate or the default self-signed Firebox certificate. The Common Name (CN), Subject Alternative Name (SAN), and other values remain the same for identity validation.

After the Firebox receives a reply and a copy of the remote server certificate from the destination HTTPS server, the Firebox presents an altered version of the certificate from the remote server (signed with the Proxy Authority CA certificate) to the originating client. When your Firebox scans an HTTPS connection with content inspection, the HTTPS-proxy intercepts the HTTPS request and initiates its own connection to the destination HTTPS server on behalf of the client. HTTPS Proxy Authority Certificate Options To examine HTTPS traffic requested by a user on your network, you must configure your Firebox to decrypt the information and then re-encrypt it with a different private key.įor more detailed information about content inspection for the HTTPS-proxy, see HTTPS-Proxy: Content Inspection.įor a demonstration of the use of certificates for outbound HTTPS content inspection, go to Outbound Content Inspection video tutorial. While your Firebox can easily examine HTTP traffic, HTTPS traffic is encrypted.

Many websites use both the HTTP and HTTPS protocols to send information to users.

Use Certificates with Outbound HTTPS Proxy Content Inspection

Mcafee total protection 10 devices