topic Re: SSL Decryption Inbound Inspection in VM-Series in the Public Cloud

SSL Decryption Inbound Inspection

omprasadax — Wed, 28 Apr 2021 10:29:18 GMT

On AWS we have deployed Application Load balancer after firewall. Can we configure ssl inbound inspection in this case?

Will it work properly, whic certificate we have to import on firewall, server certificate or ALB certificate?

Re: SSL Decryption Inbound Inspection

jmeurer — Wed, 28 Apr 2021 12:28:43 GMT

Yes, you can decrypt on the ALB to perform any URI-based policy or insert the XFF. You can choose to keep the traffic decrypted behind the ALB and the firewall will see the clear text traffic or reencrypt on the ALB and use inbound SSL decryption. Typically you would use the same cert for the ALB, backend, and firewall. At the time of this posting, the ALB does not care about mismatched certs so you could actually use a self-signed cert on the firewall.

Re: SSL Decryption Inbound Inspection

omprasadax — Thu, 29 Apr 2021 04:37:44 GMT

In SSL inbound inspection , will self signed certificate work or we would require server certificate?

Re: SSL Decryption Inbound Inspection

jmeurer — Thu, 29 Apr 2021 13:49:23 GMT

At the time of this posting, the ALB does not care about mismatched certs so you could actually use a self-signed cert on the firewall.