finjan NG-8000 Manuale utente
Version 9.2
Integrated SSL Scanning
SSL Enhancements
Page ii
© Copyright 1996-2008. Finjan Software Inc. and its affiliates and subsidiaries (“Finjan”).
All rights reserved.
All text and figures included in this publication are the exclusive property of Finjan and
are for your personal and non-commercial use. You may not modify, copy, distribute,
transmit, display, perform, reproduce, publish, license, create derivative works from,
transfer, use or sell any part of its content in any way without the express permission
in writing from Finjan. Information in this document is subject to change without notice
and does not present a commitment or representation on the part of Finjan.
The Finjan technology and/or products and/or software described and/or referenced to
in this material are protected by registered and/or pending patents including European
Patent EP 0 965 094 B1 and U.S. Patents No. 6092194, 6154844, 6167520,
6480962, 6209103, 6298446, 6353892, 6804780, 6922693, 6944822, 6993662,
6965968, 7058822, 7076469, 7155743, 7155744, 7185358, 7418731 and may be
protected by other U.S. Patents, foreign patents, or pending applications.
Finjan, Finjan logo, Vital Security, Vulnerability Anti.dote and Window-of-Vulnerability
are trademarks or registered trademarks of Finjan. Sophos is a registered trademark
of Sophos plc. McAfee is a registered trademark of McAfee Inc. Kaspersky is a
registered trademark of Kaspersky Lab. Websense® is a registered trademark of
Websense, Inc. IBM® Proventia® Web Filter is a registered trademark of IBM
Corporation. Microsoft and Microsoft Office are registered trademarks of Microsoft
Corporation. All other trademarks are the trademarks of their respective owners.
For additional information, please visit www.finjan.com or contact one of our regional
offices:
USA: San Jose
2025 Gateway Place Suite 180 San Jose,
CA 95110, USA
Toll Free: 1 888 FINJAN 8
Tel: +1 408 452 9700 Fax: +1 408 452 9701
Europe: UK
4th Floor, Westmead House, Westmead,
Farnborough, GU14 7LP, UK
Tel: +44 (0)1252 511118
Fax: +44 (0)1252 510888
salesuk@finjan.com
Israel/Asia Pacific
Hamachshev St. 1,
New Industrial Area Netanya, Israel 42504
Tel: +972 (0)9 864 8200
Fax: +972 (0)9 865 9441
salesint@finjan.com
Europe: Germany
Alte Landstrasse 27, 85521
Ottobrun, Germany
Tel: +49 (0)89 673 5970
Fax: +49 (0)89 673 597 50
salesce@finjan.com
General Information
Email: [email protected]
Internet: www.finjan.com
Europe: Netherlands
Printerweg 56
3821 AD Amersfoort, Netherlands
Tel: +31 334 543 555
Fax: +31 334 543 550
Catalog name: Integrated SSL Scanning 9.2
SSL Enhancements
Page iii
Table of Contents
1.Introduction 1
2.HTTPS Scanning 1
2.1On the Fly Certificate Generation 1
2.2Certificate Validation 2
2.3Certificate Management [new for 9.2] 6
2.4Authority Information Access [new in 9.2] 7
2.5SSL Certificate Errors 8
3.HTTPS Policies 13
4.Configuring HTTPS Support 13
4.1HTTPS Configurable Parameters 14
5.Transparent HTTPS 16
5.1Transparent HTTPS Scanning and Finjan’s Certificate 17
Integrated SSL Scanning
Page 1 Finjan proprietary and confidential
1. Introduction
The purpose of the Secure Socket Layer (SSL) is to provide security for
the transmission of data over the Internet. Security includes confidentiality,
message integrity, and authentication. SSL achieves these elements of
security through the use of cryptography, digital signatures, and
certificates.
The Finjan Vital Security series is an enterprise solution that protects
users and organizations from Web attacks, including attacks concealed in
encrypted HTTPS communication. The HTTPS functionality is integrated
into the Vital Security NG appliance, providing unified setup, management,
authentication and identification, and the ability for system administrators
to set HTTPS policies.
The HTTPS scanning solution protects enterprise networks by decrypting
HTTPS traffic and inspecting it for viruses, worms, and malicious code. It
also provides encrypted Web attack protection, certificate validation, and
content filtering.
Integrated HTTPS scanning is a license-based feature that enables the
scanning server to be configured to support HTTPS. HTTPS configuration
can be carried out system-wide or per Scanning Server.
In addition to the scanning solution for HTTP traffic, Finjan also provides
certificate validation functionality. This ensures that corporate policies
regarding certificates are enforced by automatically validating each
certificate and ensuring that the chain returns to the trusted authority. In
this way, corporate policies are maintained, while users are provided with
the benefit of being able to access SSL traffic.
2. HTTPS Scanning
When HTTPS scanning is enabled, Vital Security Scanning Server serves
as an intermediary, acting both as an HTTPS server replying to the end-
user requests, and as an HTTPS client requesting the original HTTPS
server for the content on behalf of the end-user. When the end-user
requests the server’s certificate from the Scanning Server, the Scanning
Server retrieves the certificate from the original Web server. The Scanning
Server then validates the certificate and, according to the security policy,
sends it to the user or blocks it. This transaction includes two sessions,
one between the client and the Scanning Server, and another between the
Scanning Server and the original Web server.
2.1 On-the-Fly Certificate Generation
When HTTPS Scanning is enabled, there are two HTTPS connections for
each session:
Integrated SSL Scanning
Page 2 Finjan proprietary and confidential
•Between the end-user and the Scanning Server
•Between the Scanning Server and the HTTPS server
When the end-user initially sends the request to the Scanning Server, the
Scanning Server does not have the certificate of the original Web server,
so it must retrieve the certificate before establishing the connection. The
Scanning Server retrieves the certificate from the HTTPS server and then
generates a new certificate on-the-fly, which includes the same
information as the original certificate. The Scanning Server signs the new
certificate with its own private key and sends it to the end-user.
2.2 Certificate Validation
Vital Security HTTPS ensures that corporate policies for certificates are
enforced, thereby removing the decision from the end-users by
automatically validating each certificate and ensuring that the chain
returns to the trusted authority. Policies regarding certificates are enforced
by checking individual certificate names, expiry dates, trusted authority
chains, and revocation lists.
A list of trusted certificate authorities is supplied with the system and is
used for digital signature analysis and for HTTPS certificate validation.
Digital certificate lists are updated via Finjan security updates. These lists
include the required trusted certificate authorities and Certificate
Revocation Lists (CRLs).
Certificate validation is based on the action taken according to policy type
(Bypass/Inspect Content/User Approval). When Bypass is selected, the
original server certificate is obtained, and certificate validation is not
performed by the system (no security or HTTPS validation is carried out
on traffic). If Inspect Content or User Approval is selected, the server
certificates are analyzed and replaced by a certificate containing the same
mismatches as the original. The resulting mismatches are compared
against SSL certificate conditions.
To view the certificate validation rules, navigate in the Management
Console to Policies ÆCondition Settings ÆHTTPS Certificate
Validation ÆDefault Certificate Validation Profile.
NOTE: The Default Profile can also be duplicated and adjusted
to an organization’s needs.
The Default Certificate Validation Profile comprises the
certificate error events.
Integrated SSL Scanning
Page 3 Finjan proprietary and confidential
Figure 1: Certificate Validation Profile
2.2.1 Certificate Revoked (CRLs)
The following table describes each option in the HTTPS certificate
validation profile:
Field Description
Unable to get certificate CRL The CRL of a certificate could
not be found.
Unable to decrypt CRL's signature The actual signature value could
not be determined (as opposed
to not matching the expected
value).
CRL signature failure The signature of the certificate
is invalid.
Certificate is not yet valid The notBefore date is after the
current time.
Certificate has expired The notAfter date is before the
current time.
Format error in CRL's lastUpdate field The CRL lastUpdate field
contains an invalid time.
Format error in CRL's nextUpdate field The CRL nextUpdate field
contains an invalid time.
Certificate revoked The certificate has been
revoked.
Integrated SSL Scanning
Page 4 Finjan proprietary and confidential
2.2.2 Host Cannot be Trusted
Field Description
Hostname does not match certificate name The host name does not match
the name in the certificate.
Cannot verify Hostname The host name is unavailable
and therefore cannot be verified
against the certificate.
2.2.3 Bad Certificate Usage
Field Description
Unsupported certificate purpose The supplied certificate cannot
be used for the specified
purpose.
Path length constraint exceeded The basic constraints path
length parameter has been
exceeded.
2.2.4 Invalid Security Structure
Field Description
Certificate signature cannot be decrypted The certificate signature could
not be decrypted (meaningful for
RSA keys).
Cannot decode issuer public key The public key in the certificate
SubjectPublicKeyInfo could not
be read.
2.2.5 Certificate Cannot be Trusted
Field Description
Issuer certificate could not be found This occurs if the issuer
certificate of an untrusted
certificate cannot be found.
Certificate signature failure The signature of the certificate
is invalid.
Certificate is self signed The certificate is self-signed and
cannot be found in the list of
trusted certificates.
Root certificate could not be found locally The certificate chain could be
built using the untrusted
certificates, but the root could
not be found locally.
Integrated SSL Scanning
Page 5 Finjan proprietary and confidential
Field Description
Unable to get local issuer certificate The issuer certificate of a locally
looked-up certificate could not
be found. This normally means
the list of trusted certificates is
not complete.
Unable to verify the first certificate No signatures could be verified
because the chain contains only
one certificate, and it is not self-
signed.
Certificate chain too long The certificate chain length is
greater than the supplied
maximum depth.
Invalid CA certificate Either the certificate is not a CA
or its extensions are not
consistent with the supplied
purpose.
Certificate not trusted The root CA is not marked as
trusted for the specified
purpose.
Certificate rejected The root CA is marked to reject
the specified purpose.
Subject issuer mismatch The current candidate issuer
certificate was rejected because
its subject name did not match
the issuer name of the current
certificate.
Authority and subject key identifier mismatch The current candidate issuer
certificate was rejected because
its subject key identifier was
present and did not match the
authority key identifier of the
current certificate.
Authority and issuer serial number mismatch The current candidate issuer
certificate was rejected because
its issuer name and serial
number was present and did not
match the authority key identifier
of the current certificate.
Key usage does not include certificate
signing The current candidate issuer
certificate was rejected because
its keyUsage extension did not
permit certificate signing.
Integrated SSL Scanning
Page 6 Finjan proprietary and confidential
2.2.6 Certificate is Not Currently Valid
Field Description
Certificate is not yet valid The notBefore date is after the
current time.
Certificate has expired The notAfter date is before the
current time.
2.3 Certificate Management
During the installation and setup of Vital Security, a private key is created
by the system, followed by the creation of a self-signed certificate. By
default, Vital Security signs the on-the-fly certificates using the self-
generated private key, and the end-user sees the self-signed certificated.
Certificate Management includes the following:
2.3.1 Certificate Export
System administrators have the option to export the SSL certificate from
the system to install it later on end-user machines as a trusted CA.
Installing Vital Security certificates on end-user machines will prevent the
security validation error messages for the end-users.
Figure 2: Generate Certificate Signing Request
2.3.2 Generating Certificate Signing Request
For large organizations, which employ their own CA that is already trusted
by end-users, there is the option to generate a Certificate Signing Request
(CSR). After the generation of the CSR, the system administrator can
export the request (which is signed by the private key of Vital Security)
and send it to the Certificate Authority. The CA will then generate a
Integrated SSL Scanning
Page 7 Finjan proprietary and confidential
certificate, which will be imported into Vital Security. This procedure
makes the process of exporting the certificate to end-users unnecessary.
2.3.3 Import Certificate
Vital Security system supports two types of certificate import.
•Importing a signed certificate signed by the CA after a CSR was
created by Vital Security.
•System administrators import the certificate into the system
together with the private key.
The format of the imported certificatd should be the PEM format.
2.4 Authority Information Access
Authority Information Access (AIA) is an SSL extension that indicates to
the browser how it should get information about the Certificate Authority of
the issuer of the SSL certificate. One method of Web servers is to send
the end-user the full certificate chain, after which the end-user’s browser
validates the server’s certificate and the issuer’s certificate. With AIA, the
Web server sends only the end-user’s own SSL certificate, which includes
a link to the issuers of the certificate. The end-user’s browser then follows
that link and validates the issuers of the SSL certificate.
AIA support includes two components:
Altri manuali per NG-8000
2
Questo manuale è adatto per i seguenti modelli
2
Indice
Altri manuali finjan Hardware di rete
Manuali Hardware di rete popolari di altre marche
Matrix Switch Corporation
Matrix Switch Corporation MSC-HD161DEL Manuale utente
B&B Electronics
B&B Electronics ZXT9-IO-222R2 Manuale utente
Yudor
Yudor YDS-16 Manuale utente
D-Link
D-Link ShareCenter DNS-320L Manuale utente
Samsung
Samsung ES1642dc Istruzioni per l’uso
Honeywell Home
Honeywell Home LTEM-PV Istruzioni per il montaggio
