Performing Ssl Tls Inspection Configuration

Client                  Firewall/Proxy              Web Server
  │                         │                          │
  │──TLS ClientHello──────→│                          │
  │                         │──TLS ClientHello───────→│
  │                         │←─TLS ServerHello────────│
  │                         │  (real server cert)      │
  │                         │                          │
  │                         │  [Validates server cert]  │
  │                         │  [Generates proxy cert   │
  │                         │   signed by internal CA]  │
  │                         │                          │
  │←─TLS ServerHello───────│                          │
  │  (proxy-signed cert)    │                          │
  │                         │                          │
  │──Encrypted data────────→│  [Decrypt, Inspect]      │
  │                         │──Encrypted data────────→│
  │←─Encrypted data─────────│  [Decrypt, Inspect]      │
  │                         │←─Encrypted data─────────│

Enterprise Root CA
  └── Subordinate CA (SSL Inspection)
        └── Dynamically Generated Server Certificates
             (CN matches requested server)

# Create private key for SSL Inspection CA
openssl genrsa -aes256 -out ssl-inspect-ca.key 4096

# Create CA certificate (5 year validity)
openssl req -new -x509 -key ssl-inspect-ca.key \
  -sha256 -days 1825 \
  -out ssl-inspect-ca.crt \
  -subj "/C=US/ST=California/O=Corp Inc/OU=Network Security/CN=Corp SSL Inspection CA" \
  -extensions v3_ca \
  -config <(cat <<EOF
[req]
distinguished_name = req_dn
x509_extensions = v3_ca

[req_dn]

[v3_ca]
basicConstraints = critical,CA:TRUE,pathlen:0
keyUsage = critical,digitalSignature,keyCertSign,cRLSign
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always
EOF
)

# Verify certificate
openssl x509 -in ssl-inspect-ca.crt -text -noout

# Import CA cert to trusted root store via GPO
# Computer Configuration > Policies > Windows Settings >
# Security Settings > Public Key Policies > Trusted Root CAs

# Or deploy via PowerShell
Import-Certificate -FilePath "\\server\share\ssl-inspect-ca.crt" `
  -CertStoreLocation "Cert:\LocalMachine\Root"

# Verify deployment
Get-ChildItem Cert:\LocalMachine\Root | Where-Object {
    $_.Subject -like "*SSL Inspection CA*"
}

# Install via command line
sudo security add-trusted-cert -d -r trustRoot \
  -k /Library/Keychains/System.keychain ssl-inspect-ca.crt

# Ubuntu/Debian
sudo cp ssl-inspect-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

# RHEL/CentOS
sudo cp ssl-inspect-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

# Import CA certificate to firewall
# Device > Certificate Management > Certificates > Import

# Set as Forward Trust CA
set shared certificate SSL-Inspect-CA forward-trust-certificate yes

# Create Decryption Profile
set profiles decryption Corporate-Decrypt ssl-forward-proxy block-expired-certificate yes
set profiles decryption Corporate-Decrypt ssl-forward-proxy block-untrusted-issuer yes
set profiles decryption Corporate-Decrypt ssl-forward-proxy block-unknown-cert yes
set profiles decryption Corporate-Decrypt ssl-forward-proxy restrict-cert-exts yes
set profiles decryption Corporate-Decrypt ssl-forward-proxy strip-alpn no

# Minimum TLS version
set profiles decryption Corporate-Decrypt ssl-protocol-settings min-version tls1-2
set profiles decryption Corporate-Decrypt ssl-protocol-settings max-version max

# Decryption policy - decrypt outbound HTTPS
set rulebase decryption rules Decrypt-Outbound from Trust to Untrust
set rulebase decryption rules Decrypt-Outbound source any
set rulebase decryption rules Decrypt-Outbound destination any
set rulebase decryption rules Decrypt-Outbound service any
set rulebase decryption rules Decrypt-Outbound action decrypt
set rulebase decryption rules Decrypt-Outbound type ssl-forward-proxy
set rulebase decryption rules Decrypt-Outbound profile Corporate-Decrypt

# Exempt certificate-pinned applications
set rulebase decryption rules No-Decrypt-Pinned from Trust to Untrust
set rulebase decryption rules No-Decrypt-Pinned application [ apple-update microsoft-update dropbox-base ]
set rulebase decryption rules No-Decrypt-Pinned action no-decrypt

# Exempt privacy-sensitive categories
set rulebase decryption rules No-Decrypt-Privacy from Trust to Untrust
set rulebase decryption rules No-Decrypt-Privacy category [ health-and-medicine financial-services ]
set rulebase decryption rules No-Decrypt-Privacy action no-decrypt

# Exempt specific high-trust domains
set rulebase decryption rules No-Decrypt-Trusted from Trust to Untrust
set rulebase decryption rules No-Decrypt-Trusted destination [ bank-of-america.com chase.com healthcare.gov ]
set rulebase decryption rules No-Decrypt-Trusted action no-decrypt

# Import server certificate and private key
# Device > Certificate Management > Certificates > Import

# Inbound inspection policy
set rulebase decryption rules Inspect-WebServers from Untrust to DMZ
set rulebase decryption rules Inspect-WebServers destination [ 10.0.20.10 10.0.20.11 ]
set rulebase decryption rules Inspect-WebServers service service-https
set rulebase decryption rules Inspect-WebServers action decrypt
set rulebase decryption rules Inspect-WebServers type ssl-inbound-inspection
set rulebase decryption rules Inspect-WebServers profile Corporate-Decrypt

# Test from client - verify certificate issuer is internal CA
openssl s_client -connect www.google.com:443 -servername www.google.com 2>/dev/null | \
  openssl x509 -noout -issuer -subject

# Expected output (with inspection active):
# issuer= /C=US/O=Corp Inc/OU=Network Security/CN=Corp SSL Inspection CA
# subject= /CN=www.google.com

# Verify no certificate errors in browser
# Check firewall decryption logs for errors

# Test with curl
curl -v https://www.example.com 2>&1 | grep "issuer"

# Check decryption statistics on firewall
show system setting ssl-decrypt memory
show system setting ssl-decrypt certificate-cache
show counter global filter category ssl