Define Public Applications
Enable Public App Security in Strata Cloud Manager
Understanding how App Security attracts and intercepts traffic from unmanaged, public
sources is essential before configuring public application protection. The end-to-end
traffic path follows this sequence:
DNS resolution. The client browser initiates an HTTPS request to the public
application domain (e.g., example.com). The authoritative DNS
service for that domain returns a CNAME record pointing to App Security. This
CNAME is automatically generated by App Security and must be copied and added as
a new DNS entry by the administrator.
TLS termination. Once App Security receives the incoming connection, it presents
a certificate for the protected domain that is trusted by all major browsers.
These certificates must be manually uploaded for each protected public
application.
Inspection and enforcement. With the connection established between the client
and the App Security stack, traffic flows through the inspection engine, where
App Security evaluates and enforces policies in real time.
Origin forwarding. Traffic that passes inspection is forwarded to the actual
origin server. The origin details, whether domain name or IP address, are
provided by the administrator as part of the public application definition.
Upload a Custom Domain Certificate
Each public FQDN or domain requires its own certificate. Perform the following steps
to apply a custom certificate to each app.
- Navigate to .
- Upload the custom domain certificate along with its private
key, which is required to create the FQDN. If required, include the entire
certificate chain.
This certificate will be presented to end users who access
your public application. Verify it matches your FQDN exactly, or covers it
with a wildcard.
Create a Public Application
- Navigate to and select Add Application.
- Add an Application Name, an optional
Description, and search for an optional
Group.
An application group is a collection of
applications to which an admin wants to apply identical policies. Instead of
applying similar policies to each individual application, the admin can
create an application group, add all relevant applications, and assign a
single policy to the entire group. This streamlines policy management,
making it cleaner and more efficient.
- Enter the end user's domain for Destination 1,
Port (only 443 is supported),
and Protocol.
- From the drop-down, select the Certificate for this
application, which you provided in Upload a Custom Domain
Certificate.
- Each destination needs its own Origin server or CNAME. Enter the IPv4 address or
CNAME of your origin server in the Origin field.
- To find the CNAME, select the Edit icon and choose
DNS. The DNS Record Configuration appears,
and you can copy the CNAME Value.
- Create a DNS record of type CNAME with the copied value.
