Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 13 replies
  • Answers 2 answers
  • Subscribers 7 subscribers
  • Views 32519 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL scanning implementation / Best practise (errorhandling....)

seroal

I´m interesting in your experiences with activating the ssl scanning feature. I implemented and activated it in an environment serving about 4000 users.Just to imagine, there are (per day) 11820 unique domains and 2300 unique users.

Many different webpages are visited and my experience is, that many sites are broken or not visible after activation. I have to create a lots of exceptions for ssl scanning and some for the certificate check. Sometimes I face problems with certificates, that seems to be ok (no problems with direct internet connection, works good with the same browser). What can cause this? Could it be, that the utm doesn´t know all public trusted root CAs?

So I´m interested in your experience, how to handle all this... Do you completely disable the certificate checks (because you might think the enduser would skip all the security warnings anyway? ) ? Or do you also prefer to create exceptions?

Ciao

Sebastian



This thread was automatically locked due to age.
Parents
  • 0
    Yes, that is expected behaviour..:). Some web sites and services just don't work with SSL scanning enabled, so you have to create exceptions. The easiest way is to create one Filtering Exception using Tag like "No SSL scanning sites", and then just Tag every domain or IP that you want to except.

    In my experience problems are usually related with web services (like web applications, syncs and updates), and rarely with regular HTTPS web sites.
Reply
  • 0
    Yes, that is expected behaviour..:). Some web sites and services just don't work with SSL scanning enabled, so you have to create exceptions. The easiest way is to create one Filtering Exception using Tag like "No SSL scanning sites", and then just Tag every domain or IP that you want to except.

    In my experience problems are usually related with web services (like web applications, syncs and updates), and rarely with regular HTTPS web sites.
Children
No Data
Unfiltered HTML