topic Re: SSL Offloading 'Forward Trust' grayed out in General Topics

SSL Offloading 'Forward Trust' grayed out

rz185016 — Sun, 06 Jul 2014 04:35:57 GMT

Hi,

I have created a certificate from my local CA and also have imported the CSR from PA to the local CA, created the

identity certificate, all is well, but it seems I am not able to "Check Box" the "Forward Trust Certificate" on the PA.

This it seems is a necessary step while configuring SSL offloading.

Any clues on what needs to be done ....

Please see attached.

Regards,

Tauseef

Re: SSL Offloading 'Forward Trust' grayed out

hshah — Sun, 06 Jul 2014 06:13:28 GMT

Hi RZ,

If certificate is selfsigned Root Certificate then option for "Forward Trust Certificate" & "Foreard Untrust Certificate" are Enabled. For selfsigned Root Certificate refer following image.

In your case you may not have checked option for Root Certificate. Apart from "self signed Root Cert", Suboardinate Root Certificate is supported for requested option.

Fore more information on SSL certificate refer bellow link. Go through Page 14 for certificate request.

PAN SSL Certificates

Regards,

Hardik Shah

Re: SSL Offloading 'Forward Trust' grayed out

hshah — Sun, 06 Jul 2014 06:20:20 GMT

If certificate is not "self signed root CA" or "Subordinate Root CA" than it can not generate new certificate.

thats why non-Root CA cert doesnt work in decryption.

Re: SSL Offloading 'Forward Trust' grayed out

rz185016 — Sun, 06 Jul 2014 07:47:36 GMT

Hi,

I already have a local Microsoft Root CA in our Network.

Does this mean that I have to make my device PA as Sub-CA to this Root CA ??

If so, are there any documentation on how to make my PA a sub CA to my local Root CA ?

Regards

Re: SSL Offloading 'Forward Trust' grayed out

rz185016 — Sun, 06 Jul 2014 08:37:24 GMT

Also,

What way can I monitor or have an historical view of "SSL Decrypted" statistics.... ?

How can I know how many sessions are currently decrypted for which users and so on ?

Please advise

Re: SSL Offloading 'Forward Trust' grayed out

pulukas — Sun, 06 Jul 2014 10:05:08 GMT

rz185016

See the instructions in this document to use your MS CA with SSL decryption.

How to Implement Certificates Issued from Microsoft Certificate Services

You can check the general statistics using:

>debug sslmgr statistics