Clarification on SSL Inbound Inspection re-encryption requirement and certificate usage

[R.Tabira]

Attention: Global TPM Team
Hello Team,

This is a general product behavior question.

No configuration review or TSF analysis is required.

Question 1

With SSL Inbound Inspection enabled, is the following deployment supported?

Client

↓ HTTPS

PA-440

↓ HTTP

BIG-IP (AWAF)

↓ HTTP

Web Server

Can PA-440 forward traffic as plain HTTP after decryption without establishing a new TLS session toward the downstream device?

Question 2

If re-encryption is required, can different certificates be used for each TLS session?

Example:

Client ↔ PA-440

- Public CA certificate

PA-440 ↔ BIG-IP

- Internal CA certificate

Is this a supported deployment, assuming the TLS handshake succeeds between PA-440 and BIG-IP?

A brief clarification on the supported behavior would be appreciated.

Thank you.

[reaper]

Hi

Question 1: no

The firewall opens an established connection because it has the key to allow it to look inside, it does not change any of the session parameters. the only intervention the firewall can perform is dictate which crypto will beallowed to establish the session:

e.g. setting the decryption profile to minimum version TLS1.2, will forse the client to use TLS 1.2 if it tries to establish a connection with a lower version protocol. onse the handshake is completed, the firewall will only inspect the payload and intervene only on threats

question 2: also no

The firewall does not change any of the parameters: it uses the server certificate private key to look inside, it does not proxy inbound ssl/tls connections