topic Firewall cert-SSL forward proxy-To actual destination, in General Topics

Firewall cert-SSL forward proxy-To actual destination,

SThatipelly — Fri, 27 Jul 2018 15:29:46 GMT

I know for a fact that firewall intercepts SSL connection and generates on-the-fly cert to clients under decryption scenario. But, I wasn't able to find enough resources explaning how firewall intitates connection to the actual destination on client behalf? I mean to ask does the firewall uses palo default cert as personal certificate when intitating this connection?if so,where can I find it?

Please help me understand this. TIA

Re: Firewall cert-SSL forward proxy-To actual destination,

Remo — Fri, 27 Jul 2018 18:17:02 GMT

Hi @SThatipelly

What the firewall actually does here is a Man-in-the-middle attack on TLS connections. As you already wrote it terminates the connection and presents an on the fly generated cert to the client. This is the first connection (between client and the firewall). The second one is the connection that the firewall initiates towards the server. For this connection, the firewall does initiate a connection to the server without any client certificate - simply because there is no client cert required.

If your question is about connections where a client cert is required: these connections the firewall cannot decrypt. So for these you have to configure exceptions to make them work.

Re: Firewall cert-SSL forward proxy-To actual destination,

SThatipelly — Fri, 27 Jul 2018 18:22:32 GMT

@Remo Thank you for the response. I'll try to reword my question :When firewall performs a connection to server,what certificate does it use to identify itself to server? where can I find it?

Re: Firewall cert-SSL forward proxy-To actual destination,

BPry — Fri, 27 Jul 2018 18:55:00 GMT

@SThatipelly,

It doesn't use a certificate to identify itself to the server; you can't decrypt anything that actually requires a client cert.

Re: Firewall cert-SSL forward proxy-To actual destination,

Remo — Fri, 27 Jul 2018 18:58:43 GMT

@SThatipelly

As I wrote there is no certificate that the firewall uses to identify itself. In a standard TLS handshake only the server identifies itsself to the client - not otherwise. And this is what the firewall does in this case where the firewall has the role of the client. (https://en.m.wikipedia.org/wiki/Transport_Layer_Security)