In order to play the game of TLS decryption
on the web security appliance, the web security plans
needs to have a signed certificate, an identity
certificate that they can use with all the clients.
So if you're using PKI, that's great.
Most the browsers are set to trust those CAs
as part of the PKI, the public key infrastructure.
But if we're using an enterprise CA server in-house,
we want to do is make sure that our website appliance trusted
that Root Certificate server and also had a signed identity
certificate on it, because it's going to be interacting
with all of our clients. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with all of our clients.
So what I like to do is walk you through the process
of prepping the web security appliance with an identity
certificate and the enterprise Root Certificate
so we can actually do the decryption of TLS
and have it be virtually transparent to our clients.
So our first step would be to train the WSA, the web security
appliance that it trusts, our enterprise root certificate
server.
And to do that, we can go to Network.
And under network, we have the option
for certificate management.
So we click that.
And right here is saying under Certificate Management
that there's like 250 certificates in the Cisco WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that there's like 250 certificates in the Cisco
Trusted Root Certificate List.
And to see or modify that list, we simply
click on Manage Trusted Root Certificates right here.
And as we take a look at the list, sorted alphabetically
with all the CA servers that are currently trusted,
if we want to import our enterprise Root Certificate
as a trusted CA, we simply go ahead and click on Import,
right here.
And here it's asking us to simply grab
the file so we can import it.
So in Microsoft, if we go to our Microsoft CA server,
if that's what we're using, I just happen to have one WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
if that's what we're using, I just happen to have one
at 192.168.1.117/serve.
And is where you can just download the CA certificate
right here.
So you specify the format you want,
click on Download CA certificate,
say you want to keep it.
And then boom, you have that certificate
on your file system.
Then we go back to the web secure appliance,
and we click on Choose File here.
We then go ahead and grab that file.
So I save these all into a folder I call it CA-Cert.cer.
So we select that file and then click on Submit.
That'll go ahead and import it as a Trusted Root CA. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That'll go ahead and import it as a Trusted Root CA.
So there it is in our list.
We'll go ahead and click on Submit here.
And that takes us back to the main page
for certificate management.
And then we'll click on Commit Changes.
And then we can add a comment if we
want to document what we did during that change.
So now here on the Network and Certificate Management page,
which we're looking at right here,
it shows us that we have 250 certificates in Cisco Trusted
Root Certificate List and one custom certificate.
And that's the one we just added from our CA server
in our enterprise.
So that would be a certificate authority WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that would be a certificate authority
that all of our clients internally also already trust.
So from the WSA's perspective, we now
have a Root Certificate from the enterprise that's trusted.
But we also need a signed identity certificate,
signed by that CA, for the web security appliance.
Let me show you exactly how to do that too.
To get the identity certificate on this website security
appliance signed by the CA that we just added,
we'd go over to Security Services.
And under Proxy Settings, we'd go down to HTTPS Proxy,
right here.
By default, HTTPS proxy is disabled. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
By default, HTTPS proxy is disabled.
So we'll click on Enable and Edit Settings right here.
And if this happens be the first time
that we're enabling this feature on this website appliance,
it's going to have a little pop-up that says,
do you agree to all these terms?
Yes, click on Yes to continue.
I already agreed to that previously.
And here asking for the HTTPS Proxy,
what certificate do you want to use?
Now I did a test run of this a few minutes ago.
So I'm going to go ahead and repeat that process here.
I'm going to specify that I want to generate a new certificate
and key for my identity certificate.
So I will go ahead and give this the name of wsa.ogit.com. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I will go ahead and give this the name of wsa.ogit.com.
And we'll call the organization ogit
and the organizational unit, call it
IT, country United States.
And let's say it's good for 10 months.
That's more than enough time for my lab environment
for the next few weeks.
And then we can Generate.
It says, Skeet!
I don't like it.
The country code has to be upper case.
All right, we'll do it one more time.
So Generate.
And we'll go ahead and do US.
And then click on Generate.
All right, so now that is generated,
we now go ahead and download that certificate signing WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we now go ahead and download that certificate signing
request.
So click on Download Certificate Signing Request or CSR.
And I just renamed and moved it from my Downloads folder.
So I just called it WSA-CSR2.pem.
And that's our certificate signing request.
And if we open that up--
So let's open it up with Notepad.
So here's the contents of that.
If I take that and just do a Control+A and a Control+C
to put my clipboard, I can then go back to our CA server,
just go back to the Root folder for Certificate Services here.
And say, I want to request a certificate. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And say, I want to request a certificate.
And then we go ahead and do an advanced certificate request.
And this interface may look slightly different based
on the flavor of Windows Server if you're
using a different platform.
But I'm still going to paste in here, the CSR.
And then click on Submit.
And what I did was I configured CA my services
to automatically issue the certificate when
it was requested.
That way it doesn't have to have a manual approval.
And then we'll simply download that certificate.
So this is a certificate for the web security appliance itself.
Its identity certificate signed by our trusted CA.
So we'll click on Download Certificate.
We'll click on Keep. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'll click on Keep.
So I went to my Downloads folder,
renamed it to WSA-ID-Cert2, not to be
confused with the original one that I had.
And then we'll go ahead and install
this as an identity certificate on the web security appliance.
So to do that, let me close my text editor there.
And now that we have an identity certificate,
we'll go ahead and click on Choose File right here.
And we'll take that WSA-ID-Cert2 that
was just issued to us by our certificate authority.
And once we've done that, we can scroll down and make sure
these check boxes are on.
So Decrypt for Application Detection, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So Decrypt for Application Detection,
Decrypt for Authentication.
Whatever features you want on them,
go ahead and click on right here.
And if you scroll down a bit further,
it asks how we want to handle invalid certificate
options from the internet, if it's expired
or has a mismatched host name or invalid signing certificate.
What do we want to do?
So you can pick your pleasure there.
And if your CA server and your enterprise supports OCSP,
you want to leave this enabled.
And that way you can check online
for certificates that have been revoked by that CA server.
My little CA server, I'm not set up for that.
So I'm going to leave that check off.
And then we'll click on Submit. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we'll click on Submit.
And Continue.
So here is the HTTPS proxy settings
that are enabled now, including the certificate information.
And we'll click on Commit Changes.
And if you want to leave a comment, that's fantastic.
And we'll commit again.
So we've done two basic things in this video.
We've installed a Trusted Root Certificate.
And we've also installed an identity certificate
on the website appliance that's signed by that CA.
Now the next challenge is this.
Do we want to decrypt everything that looks like TLS?
And the answer is no, we don't.
Because if a user like Bob is going out
to his banking website, we don't want WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to his banking website, we don't want
to decrypt that because we don't want the liability of seeing
that traffic naked, including passwords and other things
that he may be typing in.
So we'll take a look in the next video at a decryption policy,
and how we can limit what categories of sites
actually are going to be decrypted by the web security
appliance.
So that's our next video.
And I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.