07-07-2022 05:01 AM
Hi @LeonardoMachado ,
I haven't personally tested (and at the moment I don't have the resources to do it), but I believe you should be able to have separe Decryption rules and applying different certificate.
As you know Decryption policies/rule are working pretty much like normal firewall rule - firewall evaluating the rules top to bottom search for first match based on given information - source/dest IP, dest port, and custom URL category.
I would assume that you can do the following:
- Let say we have three servers behind the reverse proxy - a.example.com, b.example.com and c.example.com
- Create three SSL decryption rules matching destination IP the public IP of the reverse proxy (before the NAT)
- For each rule define dedicate custom URL category that will match only the FQDN for the specific site - (one URL category for "a.example.com/", one url category for "b.example.com/" and one url category for "c.example.com/")
I am imagine that when inbound connection is received it will probably match the first decryption rule (based on destination IP). When client send the "Client Hello" message during SSL negotiation, firewall will use the SNI to identify the actual requested URL and will use it as URL category match, which will trigger new policy evaluation and with the new information it should match only the one with the correct custom URL category and reply to the custmer with the corresponding certificate.
But as I mentioned, this is what would expect to happen, but not able to confirm. So it will be intersting if you have any way to test it and share the results.
Another approach - simpler but costlier - consider the use of wildcard certificate. In this case you can have single decryption rule (without the need of URL category, only dest ip and port) applying certificate *.example.com. So no matter which of the three services the user is requesting they will receive the same wildcard certificate.
The advantage of this approach is that it simplies your certificate management - you only need to renew single certificate and you don't have to make any changes on the FW when introducing new services behind the proxy
The disadvantage is that wildcard certificate could cost more.
