Configure SSL Inbound Inspection

Ensure that the appropriate interfaces are configured as either Tap, Virtual Wire, Layer 2, or Layer 3 interfaces.
You cannot use a Tap mode interface for SSL Inbound Inspection if the negotiated ciphers include PFS key exchange algorithms (DHE and ECDHE).
View configured interfaces on the
Network
Interfaces
Ethernet
tab. The
Interface Type
column displays if an interface is configured to be a
Virtual Wire
,
Layer 2
, or
Layer 3
interface. You can select an interface to modify its configuration, including the interface type.
Ensure that the targeted server certificate is installed on the firewall.
On the web interface, select
Device
Certificate Management
Certificates
Device Certificates
to view certificates installed on the firewall.
We recommend uploading a certificate chain (a single file) to the firewall if your end-entity (leaf) certificate is signed by one or more intermediate certificates
and
your web server supports TLS 1.2 and PFS key exchange algorithms. Uploading the chain avoids client-side server certificate authentication issues. You should arrange the certificates in the file as follows:
End-entity (leaf) certificate
Intermediate certificates (in issuing order)
(
Optional
) Root certificate
You can upload the server certificate and private key alone to the firewall if your web server supports
only
TLS 1.2 and the RSA key exchange algorithm
and
the server’s certificate chain (if the leaf certificate is signed by intermediate certificates) is installed on the server. SSL Inbound Inspection discusses each case in more detail.
To import the targeted server certificate onto the firewall:
On the
Device Certificates
tab, select
Import
.
Enter a descriptive
Certificate Name
.
Browse for and select the targeted server
Certificate File
.
Click
OK
.
Create a Decryption policy rule to define traffic for the firewall to decrypt and create a Decryption profile to apply SSL controls to the traffic.
Although Decryption profiles are optional, it is best to include a Decryption profile with each Decryption policy rule to prevent weak, vulnerable protocols and algorithms from allowing questionable traffic on your network.
Select
Policies
Decryption
,
Add
or modify an existing rule, and define the traffic to be decrypted.
Select
Options
and:
Set the
Action
to
Decrypt
matching traffic.
Set the
Type
to
SSL Inbound Inspection
.
Select the
Certificate
for the internal server that is the destination of the inbound SSL traffic.
(
Optional but a best practice
) Configure or select an existing
Decryption Profile
to block and control various aspects of the decrypted traffic (for example, create a Decryption profile to terminate sessions with unsupported algorithms and unsupported cipher suites).
When you configure the SSL Protocol Settings Decryption Profile for SSL Inbound Inspection traffic, create separate profiles for servers with different security capabilities. For example, if one set of servers supports only RSA, the SSL Protocol Settings only need to support RSA. However, the SSL Protocol Settings for servers that support PFS should support PFS. Configure SSL Protocol Settings for the highest level of security that the server supports, but check performance to ensure that the firewall resources can handle the higher processing load that higher security protocols and algorithms require.
Click
OK
to save.
Enable the firewall to forward decrypted SSL traffic for WildFire analysis.
This option requires an active WildFire license and is a WildFire best practice.
Commit
the configuration.
Choose your next step...
Enable Users to Opt Out of SSL Decryption.
Configure Decryption exclusions to disable decryption for certain types of traffic.