Working With Encrypted Data

Support

Go to the table of contents

Go to the previous page

Go to the next page

Go to the index

View or print as PDF

Working With Encrypted Data

Working With Encrypted Data

Help | Content Gateway | Version 7.7.3

Related topics:

Running in explicit proxy mode

Enabling SSL Manager

Internal Root CA

Managing certificates

Configuring SSL Manager for inbound traffic

Configuring SSL Manager for outbound traffic

Validating certificates

Managing Web HTTPS site access

Client certificates

Configuring SSL Manager logging

Customizing SSL connection failure messages

SSL (Secure Sockets Layer) is the industry standard for secure transmission of data on the Internet. It is based on data encryption and a system of trusted certificates issued by certificate authorities and recognized by clients and servers.

To establish an SSL connection, the client sends an SSL connection request to the server. If the server consents, the client and server use a standard handshake to negotiate an SSL connection.

When SSL Manager is enabled, SSL traffic is decrypted, inspected, and then re-encrypted before it is sent to its destination.


	Important Even when SSL Manager is not enabled and HTTPS is not decrypted, Content Gateway performs HTTPS URL filtering. This means that for every HTTPS request, a URL lookup is performed and policy is applied. In explicit proxy mode, when SSL is turned off, Content Gateway performs URL filtering based on the Host name in the request. If the site is blocked, Content Gateway serves a block page. Note that some browsers do not support display of the block page. To disable this feature, configure clients to not send HTTPS requests to the proxy. In transparent proxy mode, when SSL is turned off, Content Gateway performs URL filtering based on the Common Name in the certificate presented by the destination server. If the site is blocked, the connection with the client is dropped; no block page is served. To disable this feature when used with WCCP, do not create a service group for HTTPS.

Each SSL-based request consists of two separate sessions:

One from the client browser to SSL Manager. This is for inbound SSL traffic.

Another from SSL Manager to the Web server that will receive the secure data. This is for outbound SSL traffic.

Different certificates are required for these sessions.


	Note Content Gateway does not cache HTTPS content.

For additional information on SSL and SSL certificates, search the Internet or consult any of the commercially available books.

For information on preparing your system, see the deployment and installation material in the Websense Technical Library.

Go to the table of contents

Go to the previous page

Go to the next page

Go to the index

View or print as PDF

Working With Encrypted Data