SSL Offloading 'Forward Trust' grayed out

[rz185016]

Hi,

I have created a certificate from my local CA and also have imported the CSR from PA to the local CA, created the

identity certificate, all is well, but it seems I am not able to "Check Box" the "Forward Trust Certificate" on the  PA.

This it seems is a necessary step while configuring SSL offloading.

Any clues on what needs to be done ....

Please see attached.

Regards,

Tauseef

[hshah · Accepted solution]

Hi RZ,

If certificate is selfsigned Root Certificate then option for "Forward Trust Certificate" & "Foreard Untrust Certificate" are Enabled. For selfsigned Root Certificate refer following image.

In your case you may not have checked option for Root Certificate. Apart from "self signed Root Cert", Suboardinate Root Certificate is supported for requested option.

Fore more information on SSL certificate refer bellow link. Go through Page 14 for certificate request.

PAN SSL Certificates

Regards,

Hardik Shah

[hshah]

If certificate is not "self signed root CA" or "Subordinate Root CA" than it can not generate new certificate.

thats why non-Root CA cert doesnt work in decryption.

[rz185016]

Hi,

I already have a local Microsoft Root CA in our Network.

Does this mean that I have to make my device PA as Sub-CA to this Root CA ??

If so, are there any documentation on how to make my PA a sub CA to my local Root CA ?

Regards

RZ

[rz185016]

Also,

What way can I monitor or have an historical view of "SSL Decrypted" statistics.... ?

How can I know how many sessions are currently decrypted for which users and so on ?

Please advise

[pulukas]

rz185016

See the instructions in this document to use your MS CA with SSL decryption.

How to Implement Certificates Issued from Microsoft Certificate Services

You can check the general statistics using:

>debug sslmgr statistics