219_BLUECOAT-SGOS_5.3.x_SSL_Proxy_Reference_Guide.pdf

Blue Coat ® Systems

Reference Guide

SSL Proxy

For SGOS 5.3.1

Contact Information

Blue Coat Systems Inc.

420 North Mary Ave

Sunnyvale, CA 94085-4121

http://www.bluecoat.com/support/contactsupport

http://www.bluecoat.com

For concerns or feedback about the documentation: documentation@bluecoat.com

may be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in

whole or in part, or translated to any electronic medium or other means without the written consent of

Blue Coat Systems, Inc. All right, title and interest in and to the Software and documentation are and shall

remain the exclusive property of Blue Coat Systems, Inc. and its licensors. ProxyAV™, CacheOS™,

SGOS™, SG™, Spyware Interceptor™, Scope™, ProxyRA Connector™, ProxyRA Manager™,

Remote Access™ and MACH5™ are trademarks of Blue Coat Systems, Inc. and CacheFlow®, Blue

Coat®, Accelerating The Internet®, ProxySG®, WinProxy®, AccessNow®, Ositis®, Powering Internet

Management®, The Ultimate Internet Sharing Solution®, Cerberian®, Permeo®, Permeo Technologies,

Inc.®, and the Cerberian and Permeo logos are registered trademarks of Blue Coat Systems, Inc. All other

trademarks contained in this document and in the Software are the property of their respective owners.

BLUE COAT SYSTEMS, INC. DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER

TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND

DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE

WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE

AND NONINFRINGEMENT. IN NO EVENT SHALL BLUE COAT SYSTEMS, INC., ITS

SUPPLIERS OR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN

TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF BLUE COAT SYSTEMS, INC.

HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Document Number: 231-03025

Document Revision: SSL Proxy Reference Guide—SGOS 5.3.1 09/2008

Table of Contents

Introduction to the Blue Coat SSL Proxy

What the SSL Proxy Does

Increasing Control

SSL Proxy Overview

Understanding SSL

Using an SSL Proxy for Privacy, Authentication, and Data Integrity

SSL Proxy Versus HTTPS Reverse Proxy

Best Practices and Deployment

Question: What do I need to know before deploying the SSL Proxy? 11

Question: How do I fix server certificate errors? 12

Question: How do I selectively intercept SSL traffic? 13

Question: Can the ProxySG Distribute issuer certificates to client desktops?

Question: In addition to browser warnings, how do I create a web page to

explicitly warn users of invalid certificates and allow them the

choice to ignore the error and continue to the content? 18

Question: How do I protect end-user privacy and prevent accidental

exposure of sensitive information when intercepting SSL traffic?

Question: How do I set up SSL Proxy in explicit mode? 23

Question: How do I deploy SSL Proxy in transparent mode? 24

Question: How do I deploy the SSL Proxy in a proxy chain? 25

Question: I am using a transparent proxy deployment. How do I allow non-

SSL traffic on port 443 to certain servers while still enabling the

SSL Proxy for other port 443 traffic? 27

Question: Windows updates fail when I use the SSL Proxy to intercept all

SSL connections. 27

iii

Table of Contents

Question: Can I use CA hierarchy for certificate emulation? 28

Question: How does the HTTP Proxy securely process the CONNECT

method? 29

Question: How do I authenticate intercepted SSL traffic and add the

username to the access log? 31

Troubleshooting Tips

Can’t Reach an HTTPS Site 39

Upgrading and Using SSL Client Certificates with Internet Explorer

Logging

Microsoft

SKYPE

Error Messages

Introduction to the Blue Coat SSL Proxy

HTTPS traffic poses a major security risk to enterprises. Because SSL (Secure

Socket Layer) content is encrypted, it can’t be intercepted by normal means. Users

can bring in viruses, access forbidden sites, and leak business confidential

information over an HTTPS connection, which uses port 443.

Because IT organizations have no visibility into SSL sessions, they are blind to any

potential security threats sent over HTTPS.

In addition to the security threat, encrypted traffic makes it difficult for IT to assess

bandwidth usage and apply intelligent content control policies to ensure maximum

user productivity.

Prior to the SSL Proxy, the only solution for managing HTTPS traffic was to deny

HTTPS altogether or severely limit its usage.

What the SSL Proxy Does

The SSL Proxy can be used to tunnel or intercept HTTPS traffic. The SSL Proxy

tunnels all HTTPS traffic by default unless there is an exception, such as a certificate

error or a policy denial. In such cases the SSL Proxy intercepts the SSL connection

and sends an error page to the user. The SSL Proxy allows interception of HTTPS

traffic even when there are no errors. Such interception enables the application of

various security policies to HTTPS content.

HTTPS traffic is the

same as HTTP traffic

except that it is

encapsulated so that

the content is hidden.

Some HTTPS traffic, such as financial information, should not be intercepted, but

instead passed through in a dedicated tunnel. The following table lists the available

functions depending on whether the SSL proxy is used to tunnel or intercept HTTPS

traffic:

Table 1-1.

SSL Proxy Function

Tunneling

Interception

Validate server certificates, including revocation checks

using Certificate Revocation Lists (CRLs) and Online

Certificate Status Protocol (OCSP).

✓

Check various SSL parameters such as cipher and

version.

✓

Log useful information about the HTTPS connection.

✓

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika: