Firewall cert-SSL forward proxy-To actual destination,

[SThatipelly]

I know for a fact that firewall intercepts SSL connection  and generates on-the-fly cert to clients under decryption scenario. But, I wasn't able to find enough resources explaning how firewall intitates connection to the actual destination on client behalf? I mean to ask does the firewall uses palo default cert as personal certificate when intitating this connection?if so,where can I find it?

Please help me understand this. TIA

[Remo]

Hi @SThatipelly

What the firewall actually does here is a Man-in-the-middle attack on TLS connections. As you already wrote it terminates the connection and presents an on the fly generated cert to the client. This is the first connection (between client and the firewall). The second one is the connection that the firewall initiates towards the server. For this connection, the firewall does initiate a connection to the server without any client certificate - simply because there is no client cert required.

If your question is about connections where a client cert is required: these connections the firewall cannot decrypt. So for these you have to configure exceptions to make them work.

[SThatipelly]

@Remo Thank you for the response. I'll try to reword my question :When firewall performs a connection to server,what certificate does it use to identify itself to server? where can I find it?

[BPry]

@SThatipelly,

It doesn't use a certificate to identify itself to the server; you can't decrypt anything that actually requires a client cert. 

[Remo · Accepted solution]

@SThatipelly

As I wrote there is no certificate that the firewall uses to identify itself. In a standard TLS handshake only the server identifies itsself to the client - not otherwise. And this is what the firewall does in this case where the firewall has the role of the client. (https://en.m.wikipedia.org/wiki/Transport_Layer_Security)