topic Re: SSL forward proxy CA cert in General Topics

SSL forward proxy CA cert

SThatipelly — Fri, 08 Jun 2018 13:47:02 GMT

My enterprise has a CA root certificate pushed out to all clients. I am now planning to implement ssl decryption and want to import same cert and keys onto firewall for ssl forward proxy. what are the downsides of doing this? is it a good idea to use CA signed cert or the one I mentioned above?

TIA

Re: SSL forward proxy CA cert

BPry — Fri, 08 Jun 2018 14:58:28 GMT

@SThatipelly,

Personally I always recommend that you ask whoever manages your CA to give you a sub-CA certificate and use that for the ssl-decryption process. The sub-CA issued certs will be trusted by all of your machines and you aren't using the root certificate.