Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 13 replies
  • Answers 2 answers
  • Subscribers 7 subscribers
  • Views 32513 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL scanning implementation / Best practise (errorhandling....)

seroal

I´m interesting in your experiences with activating the ssl scanning feature. I implemented and activated it in an environment serving about 4000 users.Just to imagine, there are (per day) 11820 unique domains and 2300 unique users.

Many different webpages are visited and my experience is, that many sites are broken or not visible after activation. I have to create a lots of exceptions for ssl scanning and some for the certificate check. Sometimes I face problems with certificates, that seems to be ok (no problems with direct internet connection, works good with the same browser). What can cause this? Could it be, that the utm doesn´t know all public trusted root CAs?

So I´m interested in your experience, how to handle all this... Do you completely disable the certificate checks (because you might think the enduser would skip all the security warnings anyway? ) ? Or do you also prefer to create exceptions?

Ciao

Sebastian



This thread was automatically locked due to age.
Parents
  • 0
    I would also like to add to the previous responses by advising NOT to disable certificate validation.

    It's true that without HTTPS scanning, many users might ignore the certificate warning presented by the browser anyway. But with HTTPS scanning enabled, and certificate checking disabled, the browser would display no warnings at all. The SSL filtering has to replace the original certificate with a locally-signed one, which will always be valid and trusted for a browser that has trusted the UTM CA certificate.

    So disabling certificate validation effectively removes the ability for the browser to alert users to be on their guard. With cert validation enabled, the UTM may block some legitimate sites with minor cert issues, but it will remove the risk that a user clicking through a certificate warning will suffer a major security incident.

    Cheers
    Rich

    P.S. We do update the trusted certificate lists for the UTM but there may be times when the list gets out of sync with browsers. Feel free to submit any gaps that you notice via the feature request portal.
  • 0 in reply to RichBaldry

    I agree, we are handling it the same way right now.

    Thanks,
    Sebastian

Reply Children
No Data
Unfiltered HTML