Configure Forward Trust Certificates
Focus
Focus
Strata Cloud Manager

Configure Forward Trust Certificates

Table of Contents

Configure Forward Trust Certificates

Request forward trust issuer certificates from Next-Gen Trust Security and apply them to the firewall locations that decrypt outbound traffic.
Where Can I Use This?What Do I Need?
  • Strata Cloud Manager
  • Secure-Flex Credits
  • One of these roles for Strata Cloud Manager Shared Services: Security Administrator, Superuser
  • A Forward Trust Proxy issuer configuration in Next-Gen Trust Security for each key algorithm you use
  • An existing or new folder or snippet to apply the certificates to
Configure forward trust certificates so that Next-Gen Trust Security issues and tracks the certificates your firewalls use to decrypt outbound traffic. Certificates you request this way are generated centrally and delivered on the same configuration push your firewalls already receive.
A forward trust issuer certificate sits underneath every decrypted session for every user behind the firewall. When one expires, users get errors on every site, so managing certificates centrally removes a common outage cause.
Complete the following steps to request issuer certificates for locations you choose, apply them to your firewall decryption settings, and push the configuration to the firewalls.
  1. Select InsightsSecurityNetwork Trust Security.
  2. Select Forward Trust and click New Configuration.
  3. Under Location, choose the folder or snippet to apply the certificates to.
  4. Enter a Configuration Name and a Common Name.
    Strata Cloud Manager names the certificates by appending _Trust_RSA and _Trust_ECDSA to the common name you enter.
  5. For RSA Issuer Configuration, choose the Issuer Configuration for the RSA key algorithm created in Next-Gen Trust Security.
    Strata Cloud Manager fills in RSA Key Type and RSA Validity Period.
  6. For ECDSA Issuer Configuration, choose the Issuer Configuration for the ECDSA key algorithm created in Next-Gen Trust Security.
    Strata Cloud Manager fills in ECDSA Key Type and ECDSA Validity Period.
  7. Click Configure Decryption Settings and wait for Next-Gen Trust Security to generate the two issuer certificates.
    If generation fails, confirm that each issuer configuration exposes a Sub CA Provider set to the key algorithm you requested. Use an RSA provider for the RSA slot and an ECDSA provider for the ECDSA slot.
  8. Under Configure Decryption Settings, compare the Current Configuration in the left column against the Updated Configuration in the right column that you will apply to Forward Trust Proxy.
    Both columns separate Certificate When Proxying for Trusted Site from Certificate When Proxying for Untrusted Site and list the RSA and ECDSA certificates for each. Locations showing Multiple are not all using the same certificate.
  9. In the right column, under Certificate When Proxying for Trusted Site, choose the RSA and ECDSA certificates you generated if they do not appear.
  10. (Optional) Under Certificate When Proxying for Untrusted Site, click Generate for RSA and ECDSA.
    Untrusted certificates control what happens to traffic your firewall can't validate. If generated, the user gets through with a browser warning; otherwise, the firewall blocks the site. Strata Cloud Manager issues untrusted certificates locally and Next-Gen Trust Security doesn't track them.
  11. Click Configure to finish configuring forward trust certificates.
    Under Decryption Certificate Configuration, the new certificates appear in the row for the location you configured.
  12. Click Push Config to send the certificates to your firewalls.