SSL configuration settings for outbound traffic

Use Configure > SSL > Decryption / Encryption > Outbound to configure SSL and TLS settings, session cache, and ciphers for outbound traffic (Content Gateway to the origin server).

Under Protocol Settings, indicate which protocols you want Content Gateway to support. Supported protocols are:

SSLv2

SSLv3 (enabled by default)

TLSv1 (enabled by default)


	Note TLSv1.1 and TLSv1.2 are also supported. Both are disabled by default for outbound connections. They are enabled/disabled with records.config variables: proxy.config.ssl.client.TLSv11 INT 0 --(0 = disabled) proxy.config.ssl.client.TLSv12 INT 0 --(0 = disabled) When Content Gateway is on a Websense appliance, use the Appliance manager Toolbox Command Line Utility to set the value. When Content Gateway is installed as software, use "content_line -s" on the Linux command line to set the value.

Select the protocols that your organization's security policy has adopted.

You must select at least one protocol.

You can select different protocols for inbound traffic.

Select Session Cache if you want to cache keys until the time specified in Session Cache Timeout expires. This can improve performance. If keys are not cached, each request is negotiated again.

Setting the Session Cache Timout to 0 (zero) causes session caching to be disabled.

Indicate, in seconds, how long keys should be kept in the cache. The default is 300 seconds (5 minutes).

The cipher list describes available algorithms and level of encryption between Content Gateway and the origin server.

The Default setting indicates to use all available ciphers except the eNULL, ADH, and EXP suites.

The strongest cipher (providing the highest level of encryption) is applied first. This can be set to a different level of encryption than for inbound traffic.

Additional cipher settings are:

High encryption cipher suites: those with key lengths larger than 128 bits, and some cipher suites with 128-bit keys.

Medium encryption cipher suites: those using 128 bit encryption.

Low encryption cipher suites: those using 64- or 56-bit encryption algorithms but excluding export cipher suites.

For outbound requests, consider using one of the higher encryption levels to improve security.

For more information on ciphers, refer to www.openssl.org/docs.

Click Apply.

Click Restart on Configure > My Proxy > Basic > General.