topic Re: How to match custom SSL based applications in General Topics

How to match custom SSL based applications

apackard — Thu, 19 May 2011 17:06:53 GMT

I'm trying to tag a particular application protocol that used TLS/SSL as a security wrapper.

The most accurate way I can ID this application protocol is to match against the FQDN subjectName returned by the server during the certificate handshake.

I've setup a custom App-ID configured as:-

Parent App: ssl

Port: tcp/443

Pattern Match: Context: ssl-rsp-certificate, Pattern: server\.domain\.com

but this isn't matching. I've also tried using the Context type: ssl-rsp-server-hello and this too fails.

I have confirmed with a tcpdump that this string is present in the server response.

Any clues greatfully received!

Re: How to match custom SSL based applications

schiang1 — Tue, 07 Jun 2011 03:27:28 GMT

show session all filter source x.x.x.x destination y.y.y.y

What does the application get identified as?

Maybe try:

Pattern Match: Context: ssl-rsp-certificate, pattern server.domain\.com

Re: How to match custom SSL based applications

Sebbb — Fri, 19 Aug 2011 15:51:19 GMT

Hi,

I have to solve the same problem : identifing an internal application using ssl certificate CN, but defining a custom application, overriding ssl app and matching ssl-rsp-certificate don't work.

Any other idea to use certificate CN to identify a web-based ssl application ?

Regards,

Sébastien B.

Soft ver. 3.1.4 and up-to-date app-thread pack.