What problems or vulnerabilities does this present?

Stevenjw0728 — Fri, 17 Feb 2023 20:40:56 GMT

IMPORTANT NOTE: Never set both checkboxes "Forward Trust Certificate" and "Forward Untrust Certificate" in the same certificate, and do not have the "Forward Untrust Certificate" deployed under a trusted certificate chain. If you do this, it will cause the firewall to present client devices with a CA certificate they trust, even when they connect to websites or applications that are presenting with invalid certificates to the firewall.

My SSL inspection cert is selected forward trust, forward untrust, and trusted root CA...

I am using an MS CA setup.

Re: What problems or vulnerabilities does this present?

Adrian_Jensen — Sat, 18 Feb 2023 00:13:41 GMT

This is all really about preserving the untrusted state of an invalid internet certificate when you have SSL decryption in the PA and passed that connection to an internal client.

When you decrypt a public site with a valid SSL certificate on the PA, you intercept the SSL connection, decrypt the data, and then re-sign the connection to the internal client with your own internally trusted certificate (either a self-signed certificate, or an internal CA-signed certificate, that you have distributed to your clients). The client sees the HTTPS connection as secure because the connection is signed by a certificate it trusts (the PA). This is the "Forward Trust Certificate" setting.

However, when your client is connecting to an internet site that has an invalid certificate for whatever reason (is invalid for the host, fraudulent, self-signed, etc.), you want to preserve that invalid state so the client browser warns the end user. If you were to SSL decrypt and re-sign the connection with your trusted PA certificate, then the client will trust the public site even though it has an untrusted internet certificate. Therefore, you want to create a second untrusted certificate on the PA (which is not internally signed or distributed to the clients) and use that certificate to re-sign the untrusted internet connections - associated to the "Forward Untrust Certificate". That way the client sees an untrusted certificate in the connection and warns the end user.

topic What problems or vulnerabilities does this present? in Next-Generation Firewall Discussions

What problems or vulnerabilities does this present?

Re: What problems or vulnerabilities does this present?