HTTPS Inspection from the Inernet

[Martin_Sykora]

Hi.

Our customer wants to do some URL filtering for incoming HTTP(S) requests from the Internet. Since HTTPS is involved and the gateway does not see into the web traffic, all URL filtering rules for this case are useless until I turn on HTTPS inspection.
If I understand  Checkpoints HTTPS inspection implementation correctly, the certificate that is used by the gateway that is doing the inspection will show up on the client side as the CA of the fake certificates that the gateway will generate in order do the man in the middle action. If I am doing this for traffic from inside of my company, because I can "teach" my machines to trust my gateway as a CA.
I am expecting that clients from the Internet will always show an certificate error each time the HTTPS traffic will go through the inspecting gateway because the my gateway's certificate is not on the list of globally trusted CAs, which makes this a pretty unelegant solution.

Can you please confirm my understanding of this scenario and if the behavior will be really as I have described it?

Martin

[Gomboragchaa]

Security Gateway uses certificates and becomes an intermediary between the client computer and the secure web site.

Here is a lot of useful information Best Practices - HTTPS Inspection.

HTTPS Inspection - Inbound vs. Outbound

- Outbound HTTPS Inspection protects internal users and perimeter servers from malicious attacks coming from the Internet on connections originated from inside the organization.

- Inbound HTTPS Inspection protects internal servers (for example, data centers and web servers) from malicious attacks coming from the Internet.

[Vladimir]

The inbound HTTPS inspection presenting Web Server's original certificate to the client, not the one issued by Check Point CA. THe gateway is using its own certificate when initiating connection from itself to the Web Server for self-identification of the session established on behalf of the client, as depicted in the bottom row of this diagram: