topic Re: Is there SNI support for inbound HTTPS inspection in R80.20? in Firewall and Security Management

Is there SNI support for inbound HTTPS inspection in R80.20?

Paolo_Francese — Tue, 14 May 2019 14:35:16 GMT

Hi,

on gws R80.20 can I do HTTPS inspection on inbound connections that require SNI since on the server there are some virtual hosts with different certificates? If yes how?

Thanks in advance

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

PhoneBoy — Fri, 17 May 2019 17:16:08 GMT

Not sure why it is necessary to inspect the SNI since the HTTPS Inspection sees the actual URL.
A more relevant question might be: do we duplicate the SNI from the client as part of the connection we made to the server?
Not sure.

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

Paolo_Francese — Tue, 21 May 2019 09:14:27 GMT

Sorry, maybe I was not clear enough. My question is: is there SNI support in R80.20?

What I would like to do is inspect HTTPS traffic that go toward some virtual hosts running on a server behind CP gws. Every virtual host has its own certificate.

Thanks

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

Kosin_Usuwanthi — Tue, 21 May 2019 10:24:08 GMT

Not sure is this your expect.

R80.30

State-of-the-Art HTTPS Inspection: New SSL Inspection Patent Pending Technologies. Delivering the power to inspect SSL-encrypted network traffic with secure SNI verification improvements.

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

PhoneBoy — Tue, 21 May 2019 15:29:38 GMT

Most of the requests for support for SNI are usually about Outbound Inspection.
More specifically, it's to see what site is really being accessed without resorting to HTTPS Inspection.

With inbound HTTPS Inspection, the connection will terminate on the gateway.
This requires the private certificate of the site in question.
We'll be able to see the exact URL the end user specifies in this case.
As such, we don't need SNI.

A network diagram would be very helpful to understand what you're trying to achieve.

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

Michele_Gullia — Fri, 27 Sep 2019 15:43:09 GMT

"With inbound HTTPS Inspection, the connection will terminate on the gateway.
This requires the private certificate of the site in question.
We'll be able to see the exact URL the end user specifies in this case."

The URL is encrypted in the TLS sessions so the gateway needs to see the SNI, read what host the client needs to reach and select the right certificate to expose.

So in my opinion the SNI support it's necessary in inboud https inspection

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

PhoneBoy — Fri, 27 Sep 2019 22:51:41 GMT

The URL being accessed is part of the HTTP request, which doesn't require SNI to see.
I've also never heard of anyone having inbound SNI issues.
In any case, we do SNI validation as part of R80.30.

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

Paolo_Francese — Mon, 30 Sep 2019 09:12:38 GMT

What I do not understand is:

if I've a HTTPS server with only one IP and 10 virtual hosts, this server is behind a CP firewall how can I inspect traffic?

I cannot use HTTPS inspection because I've 10 certificates and only one IP, writing HTTPS inspection rule require to have one IP and one certificate, or am I wrong?

B-)

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

PhoneBoy — Mon, 30 Sep 2019 15:25:00 GMT

With 10 different certificates, it definitely would not work.
At a minimum, you'd have to create a new certificate that would be valid for all 10 hosts.
Specifically, it would have to list all 10 hosts in the Subject Alternate Name (SAN) field.
This will allow the remote browser to validate the certificate regardless of which of the 10 hosts you're ultimately accessing.
This certificate would then be used for Inbound SSL Inspection for all 10 sites.
Again, none of this has anything to do with SNI, which only matters when we're not terminating the TLS connection.

What I don't know is whether or not you can leave the certificate as-is on the other hosts.
Assuming the Security Gateway can validate those certificates as valid, I assume it would still work.

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

Kosin_Usuwanthi — Tue, 01 Oct 2019 04:50:33 GMT

For my case I need to block external user to access some website behide the gateway.

I have use custom application tool (sk103051) for custom SSL traffic with SNI. It works for blocked some website from same IP address.

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

Alejandro_Ferna — Tue, 15 Oct 2019 10:05:34 GMT

We have more than a hundred certificates in the same webserver (half of them are wildcards) and adding/replacing every month. To use only one certificate, even a SAN certificate, is not an option for us.

Do you know if it's there any chance to allow more than one certificate assigned to the same destination host for the https inbound analysis rules?

Regards!

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

PhoneBoy — Sat, 19 Oct 2019 21:17:33 GMT

This is not possible because of how TLS works, i.e. it's not a Check Point specific limitation.
Specifically, the server must present its server certificate before the client can communicate what host it is connecting to via SNI.
As such, the server certificate must be valid for all possible servers accessible from that IP address.

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

HeikoAnkenbrand — Sun, 20 Oct 2019 20:50:50 GMT

Hi @Paolo_Francese ,

R80.20 with enabled HTTPS interception:

If the https interseption is enabled, the parameter host from http can be used for the url because the traffic is analyzed by active streaming. Check Point Active Streaming (CPAS) allow the changing of data, we play the role of “man in the middle”. CPAS breaks the connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.). An application is register to CPAS when a connection start and supply callbacks for event handler and read handler. Several protocols uses CPAS, for example: HTTPS, VoIP (SIP, Skinny/SCCP, H.323, etc.), Security Servers processes, etc. CPAS breaks the HTTPS connection into two parts using our own stack – this mean, we are responsible for all the stack work (dealing with options, retransmissions, timers etc.)

More read here: R80.x Security Gateway Architecture (Content Inspection)

R80.20 without enabled HTTPS interception:

If the https interseption is disabled, SNI is used to recognize the virtual URL for application control and url filtering.

More read here: URL Filtering using SNI for HTTPS websites.pdf

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

HeikoAnkenbrand — Sun, 20 Oct 2019 19:54:29 GMT

Better use R80.30:-)

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

PhoneBoy — Fri, 25 Oct 2019 01:31:43 GMT

R80.20 with JHF 117 and above apparently has the improved SNI support.
If you're on an earlier JHF, we are not looking at SNI.

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

SolidBE — Tue, 05 Nov 2019 13:52:10 GMT

Hi,

When hosting different websites with different certificates (no wildcard) on the same IP address, it is not possible to configure this at the moment, so I guess this means there is no SNI support for inbound HTTPS?

Regards,

Erik

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

PhoneBoy — Tue, 05 Nov 2019 14:37:52 GMT

Again, this issue has nothing to do with (lack of) SNI support.
It's a function of how TLS works.
If a given IP serves multiple HTTPS websites, the certificate presented must be valid for all the websites.

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

SolidBE — Tue, 05 Nov 2019 14:53:34 GMT

Hi PhoneBoy,

It is possible to configure multiple independent certificates (different domains, so no wildcard possible) on a single IP. This only works with browsers and webservers that support SNI. But since this is currently not configurable in the HTTPS inspection I suppose this feature is not supported.

Or will it work if we add multiple rules with the same source IP, destination IP and port number, but different inbound certificates?

Regards,

Erik

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

PhoneBoy — Tue, 05 Nov 2019 15:07:55 GMT

Not sure it works that way, but you can try it on R80.30 or R80.20 JHF 117 or later.

Re: Is there SNI support for inbound HTTPS inspection in R80.20?

PhoneBoy — Wed, 06 Nov 2019 07:21:37 GMT

I checked with our experts in R&D and, provided you are on R80.30, you should be able to achieve it.
It should also work on R80.20 JHF 117 and above, but not sure it was tested there.

You can import the certificates into the gateway, create different custom application with each URL, and create an HTTPS Inspection rule with different certificate for each custom certificate similar to the following: