Inbound HTTPS Inspection - Importing Certificate

[Digo11]

Hello Experts.

I am trying to perform inbound HTTPS inspection; I do not have any private key password assigned to the certificate (wildcard certificate). While trying to import the internal server certificate for the inbound rules, I cannot import the certificate without providing the password.

Is there a way to skip/bypass the private key password section? It shows an error when I try to skip the password section.

*Note: When I provide the export password of the certificate in the private key password section, it accepts and imports the certificate. 

Thanks in advance!!

Regards,

Digo.

[Sorin_Gogean · Accepted solution]

Hello @Digo11 ,

Not sure if you were kidding when you asked for "a way to skip/bypass the private key " 🙂.

From CKP HTTPS Inspection documentation, we have the below paragraph explaining what is need:

When a client from outside the organization initiates an HTTPS connection to an internal server, the Security Gateway intercepts the traffic. The Security Gateway inspects the inbound traffic and creates a new HTTPS connection from the gateway to the internal server. To allow HTTPS Inspection, the Security Gateway must use the original server certificate and private key. The Security Gateway uses this certificate and the private key for SSL connections to the internal servers.

Inbound HTTPS Connections Inbound connections are HTTPS connections that arrive from an external client and connect to a server in the DMZ or the internal network. Inbound connection flow An HTTPS request (from an external client to an internal server) arrives at the Security Gateway. The Security Gateway inspects the HTTPS request. The Security Gateway determines whether the HTTPS request matches an existing HTTPS Inspection rule: If the HTTPS request does not match a rule, then the Security Gateway does not inspect the HTTPS payload. If the HTTPS request matches a rule, then the Security Gateway continues to the next step. The Security Gateway uses the certificate for the internal server to create an HTTPS connection with the external client. The Security Gateway creates a new HTTPS connection with the internal server. The Security Gateway decrypts the HTTPS connection. The Security Gateway inspects the decrypted HTTPS connection. If the Security Policy allows this traffic, the Security Gateway encrypts the HTTPS connection and sends it to the internal server.

Now on your problem, you can't, because when we do INBOUND HTTP Inspection , meaning we decrypt traffic that comes from outside to our DMZ servers, the CKP HAS TO Present itself as the "original server", therefore, in order to do that, the server SSL certificate and the private key, needs to be installed to he can substitute itself into the communication.

As example:

Hopefully is clearer for you now.

Ty,

[Digo11]

Hi Sorin_Gogean,

Good day!!

Thanks a lot for explaining the connection flow. Somehow, I was able to import the certificate by entering the "export" password that I had created at the time of exporting the certificate. I had to convert the certificate to .P12 format as it was originally in .PEM format.

I used the certificate for inbound inspection and the traffic is getting inspected as seen in the logs. I will check further and post here if assistance is required.

Thanks!!

[the_rock]

Good job! 👍

[the_rock]

Here is also a very good reference doc for you. This was given to me by TAC couple of years back, but it explains inspection very well.

Andy

[Sorin_Gogean]

Glad it helped @Digo11 😊

[the_rock]

What @Sorin_Gogean gave pretty much explains it all. Sadly, there is NO way to skip private key portion, thats the whole point actually of this process, otherwise, it would not be secure.