What problems or vulnerabilities does this present?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

What problems or vulnerabilities does this present?

L1 Bithead

IMPORTANT NOTE: Never set both checkboxes "Forward Trust Certificate" and "Forward Untrust Certificate" in the same certificate, and do not have the "Forward Untrust Certificate" deployed under a trusted certificate chain. If you do this, it will cause the firewall to present client devices with a CA certificate they trust, even when they connect to websites or applications that are presenting with invalid certificates to the firewall.


My SSL inspection  cert is selected forward trust, forward untrust, and trusted root CA...


I am using an MS CA setup.


L6 Presenter

This is all really about preserving the untrusted state of an invalid internet certificate when you have SSL decryption in the PA and passed that connection to an internal client.


When you decrypt a public site with a valid SSL certificate on the PA, you intercept the SSL connection, decrypt the data, and then re-sign the connection to the internal client with your own internally trusted certificate (either a self-signed certificate, or an internal CA-signed certificate, that you have distributed to your clients). The client sees the HTTPS connection as secure because the connection is signed by a certificate it trusts (the PA). This is the "Forward Trust Certificate" setting.


However, when your client is connecting to an internet site that has an invalid certificate for whatever reason (is invalid for the host, fraudulent, self-signed, etc.), you want to preserve that invalid state so the client browser warns the end user. If you were to SSL decrypt and re-sign the connection with your trusted PA certificate, then the client will trust the public site even though it has an untrusted internet certificate. Therefore, you want to create a second untrusted certificate on the PA (which is not internally signed or distributed to the clients) and use that certificate to re-sign the untrusted internet connections - associated to the "Forward Untrust Certificate". That way the client sees an untrusted certificate in the connection and warns the end user.

  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!