Inspect SSL traffic

You can configure SSL inspection for a given credential-port pair on one or more interfaces of your protected computer.

Credentials can be imported in PKCS#12 or PEM format. The credential file must include the private key. Windows computers can use CryptoAPI directly.

In this topic:

• Configure SSL inspection
• Change port settings
• Use Intrusion Prevention when traffic is encrypted with Perfect Forward Secrecy (PFS)
• Supported cipher suites
• Supported protocols

Configure SSL inspection

1. In Deep Security Manager, select the computer to configure and click Details to open the computer editor.
2. In the left pane of the computer editor, select Intrusion Prevention > Advanced > View SSL Configurations, and click View SSL Configurations to display the SSL computer Configurations window.
3. Click New to display the first page of the SSL Configuration wizard.
4. Specify the interface to which to apply the interfaces on this computer:
   • To apply to all interfaces on this computer, select All Interface(s).
   • To apply to specific interfaces, select Specific Interface(s).
5. Select Port(s) or Ports List and select a list, then click Next.
6. On the IP Selection screen, select All IPs or provide a Specific IP on which SSL intrusion prevention analysis should take place, then click Next.
7. On the Credentials screen, select the method of providing credentials:
   • I will upload credentials now
   • The credentials are on the computer
   The credential file must include the private key.
8. If you will upload credentials now, enter their type, location, and pass phrase (if required).
9. If the credentials are on the computer, provide Credential Details.
   
   • If you are using PEM or PKCS#12 credential formats stored on the computer, identify the location of the credential file and the file's pass phrase (if required).
   • If you are using Windows CryptoAPI credentials, choose the credentials from the list of credentials found on the computer.
10. Provide a name and description for this configuration.
11. Look over the Summary and close the SSL Configuration Wizard. Read the summary of the configuration operation and click Finish to close the wizard.

Change port settings

Change the port settings for the computer to ensure that the agent is performing the appropriate intrusion prevention filtering on the SSL-enabled ports. The changes you make are applied to a specific application type, such as Web Server Common, on the agent computer. The changes do not affect the application type on other computers.

1. Go to Intrusion Prevention Rules in the computer's Details window to see the list of intrusion prevention rules being applied on this computer.
2. Sort the rules by Application Type. Scroll down the list to find the application type that are running on this computer, such as "Web Server Common".
3. Override the inherited "HTTP" Port List so that you include the port you defined during the SSL Configuration setup as well as port 80. Enter the ports as comma-separated values. For example, if you use port 9090 in the SSL configuration, enter 9090, 80.
4. Click OK to close the dialog.

Use Intrusion Prevention when traffic is encrypted with Perfect Forward Secrecy (PFS)

Perfect Forward Secrecy (PFS) can be used to create a communication channel that cannot be decrypted if, at a later time, the server's private key is compromised. Since the intent of Perfect Forward Secrecy is to prevent decryption after the session is over, it also prevents SSL inspection through the Deep Security intrusion prevention module.

To work around this issue, we recommend you do the following:

1. Use Perfect Forward Secrecy for TLS traffic between the Internet and your load balancer (or reverse proxy).
2. Terminate the Perfect Forward Secrecy session at your load balancer (or reverse proxy).
3. Use a non-PFS cipher suite (see Supported cipher suites below) for traffic between the load balancer (or reverse proxy) and the web server or application server, so that the intrusion prevention module on the server can decrypt the TLS sessions and inspect them.
4. Restrict traffic to the web server for application server ports that do not use Perfect Forward Secrecy.

Special considerations for Diffie-Hellman ciphers

Perfect Forward Secrecy relies on the Diffie-Hellman key exchange algorithm. On some web servers, Diffie-Hellman might be the default, which means that SSL inspection won't work properly. It is therefore important to check the server's configuration file and disable Diffie-Hellman ciphers for TLS traffic between the web server and load balancer (or reverse proxy). For example, to disable Diffie-Hellman on an Apache server:

1. Open the server's configuration file. The file name and location of web server configuration files vary by operating system (OS) and distribution. For example, the path could be:
   • Default installation on RHEL4: /etc/httpd/conf.d/ssl.conf
   • Apache 2.2.2 on Red Hat Linux: /apache2/conf/extra/httpd-ssl.conf

1. In the configuration file, find the " SSLCipherSuite " variable.
2. Add !DH:!EDH:!ADH: to these fields, if this string does not already appear. (The " ! " tells Apache to "not" use this cipher.)
3. For example, you might edit the Apache configuration file's cipher suite to look like this:

SSLCipherSuite !DH:!EDH:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

For more information, see the Apache Documentation for SSLCipherSuite : http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslciphersuite.

Supported cipher suites

Hex Value	OpenSSL Name	IANA Name	NSS Name
0x00,0x04	RC4-MD5	TLS_RSA_WITH_RC4_128_MD5	SSL_RSA_WITH_RC4_128_MD5
0x00,0x05	RC4-SHA	TLS_RSA_WITH_RC4_128_SHA	SSL_RSA_WITH_RC4_128_SHA
0x00,0x09	DES-CBC-SHA	TLS_RSA_WITH_DES_CBC_SHA	SSL_RSA_WITH_DES_CBC_SHA
0x00,0x0A	DES-CBC3-SHA	TLS_RSA_WITH_3DES_EDE_CBC_SHA	SSL_RSA_WITH_3DES_EDE_CBC_SHA
0x00,0x2F	AES128-SHA	TLS_RSA_WITH_AES_128_CBC_SHA	TLS_RSA_WITH_AES_128_CBC_SHA
0x00,0x35	AES256-SHA	TLS_RSA_WITH_AES_256_CBC_SHA	TLS_RSA_WITH_AES_256_CBC_SHA
0x00,0x3C	AES128-SHA256	TLS_RSA_WITH_AES_128_CBC_SHA256	TLS_RSA_WITH_AES_128_CBC_SHA256
0x00,0x3D	AES256-SHA256	TLS_RSA_WITH_AES_256_CBC_SHA256	TLS_RSA_WITH_AES_256_CBC_SHA256
0x00,0x41	CAMELLIA128-SHA	TLS_RSA_WITH_CAMELLIA_128_CBC_SHA	TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
0x00,0x84	CAMELLIA256-SHA	TLS_RSA_WITH_CAMELLIA_256_CBC_SHA	TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
0x00,0xBA	CAMELLIA128-SHA256	TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256	TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256
0x00,0xC0	not implemented	TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256	TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256
0x00,0x7C	not implemented	TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256	TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
0x00,0x7D	not implemented	TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384	TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384
0x00,0x7E	not implemented	TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256	TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256

Supported protocols

Protocol
SSL 3.0
TLS 1.0
TLS 1.1
TLS 1.2