SSL Decryption


	Important All SSL decryption settings should be made in the Content Gateway manager. None of the variables in the table below should be modified directly in records.config.


Configuration Variable	Data Type	Default Value	Description
proxy.config. ssl.enabled	INT	1	When enabled (1), Content Gateway accepts SSL connections and performs URL filtering before establishing a connection with the origin server. See proxy.config. ssl_decryption. use_decryption to enable SSL decryption.
proxy.config. ssl_decryption. use_decryption	INT	0	When enabled (1), Content Gateway accepts and decrypts SSL traffic. See Working With Encrypted Data.
proxy.config. ssl_decryption_ports	INT	443	Specifies the HTTPS ports. Content Gateway allows SSL decryption and policy lookup only to the specified ports.
proxy.config. ssl_server_port	INT	8080	The port on which Content Gateway listens for client SSL traffic.
proxy.config. administrator_id	STRING	NULL	Do not change. Holds the encrypted administrator ID.
proxy.config. ssl_decryption. tunnel_skype	INT	0	When enabled (1), Content Gateway identifies and tunnels Skype traffic (explicit proxy deployments only). User policies must be adjusted accordingly. See the configuration information in Enabling SSL support.
proxy.config. ssl_decryption. tunnel_unknown_protocols	INT	0	Enables (1) or disables the tunneling of unrecognized protocols using SSL ports.
proxy.config. ssl_decryption. tunnel_unknown_protocols_timeout	INT	10	Specifies the time in seconds that Content Gateway waits for the "client hello" response before tunneling the request as an unknown protocol.
proxy.config.ssl.server.SSLv2	INT	0	When enabled (1), Content Gateway accepts SSLv2 connections from clients. (In this case, "server" refers to Content Gateway's role as server to the client.)
proxy.config.ssl.server.SSLv3	INT	0	When enabled (1), Content Gateway accepts SSLv3 connections from clients. (In this case, "server" refers to Content Gateway's role as server to the client.)
proxy.config.ssl.server.TLSv1	INT	1	When enabled (1), Content Gateway accepts TLSv1 connections from clients. (In this case, "server" refers to Content Gateway's role as server to the client.)
proxy.config.ssl.server.TLSv11	INT	1	When enabled (1), Content Gateway accepts TLSv1.1 connections from clients. (In this case, "server" refers to Content Gateway's role as server to the client.)
proxy.config.ssl.server.TLSv12	INT	1	When enabled (1), Content Gateway accepts TLSv1.2 connections from clients. (In this case, "server" refers to Content Gateway's role as server to the client.)
proxy.config.ssl.client.SSLv2	INT	0	When enabled (1), Content Gateway accepts SSLv2 connections from origin servers. (In this case, "client" refers to Content Gateway's role as client to the origin server.)
proxy.config.ssl.client.SSLv3	INT	0	When enabled (1), Content Gateway accepts SSLv3 connections from origin servers. (In this case, "client" refers to Content Gateway's role as client to the origin server.)
proxy.config.ssl.client.TLSv1	INT	1	When enabled (1), Content Gateway accepts TLSv1 connections from origin servers. (In this case, "client" refers to Content Gateway's role as client to the origin server.)
proxy.config.ssl.client.TLSv11	INT	0	When enabled (1), Content Gateway accepts TLSv1.1 connections from origin servers. (In this case, "client" refers to Content Gateway's role as client to the origin server.)
proxy.config.ssl.client.TLSv12	INT	0	When enabled (1), Content Gateway accepts TLSv1.2 connections from origin servers. (In this case, "client" refers to Content Gateway's role as client to the origin server.)
proxy.config.ssl.client.TLS_padding	INT	1	When enabled (1), Content Gateway will add padding to ensure a "client hello" does not hang the connection
proxy.config.ssl.server. cipherlist_option	STRING	Default	Specifies the client-to-proxy cipher setting. Values are: Default High Medium Low See SSL configuration settings for inbound traffic.
proxy.config.ssl.server. cipherlist	STRING	ALL:!ADH:@STRENGTH:!EXP	The cipher list that corresponds to the cipher_list option setting.
proxy.config.ssl.client. cipherlist_option	STRING	Default	Specifies the cipher list setting. Values are: Default High Medium Low See SSL configuration settings for outbound traffic.
proxy.config.ssl.client. cipherlist	STRING	ALL:!ADH:@STRENGTH:!EXP	The cipher list that corresponds to the cipher_list option setting. See the preceding entry.
proxy.config.ssl.server. session_cache	INT	1	Enables (1) or disables the SSL server session cache.
proxy.config.ssl.server. session_cache_timeout	INT	300	Specifies the SSL server session cache timeout period. The default is 300 seconds (5 minutes).
proxy.config.ssl.client. session_cache	INT	1	Enables (1) or disables the SSL client session cache.
proxy.config.ssl.client. session_cache_timeout	INT	300	Specifies the SSL client session cache timeout period. The default is 300 seconds (5 minutes).
proxy.config.ssl.client. certification_level	INT	0	Specifies whether client certificates are not needed, optional, or required. certification level should be: 0 = no client certificates 1 = client certificates optional 2 = client certificates required
proxy.config.ssl.server.cert. filename	STRING	server.crt.pem	Specifies the server certificate filename.
proxy.config.ssl.server. private_key.filename	STRING	Domainkey.pem	Specifies the private key for the server certificate.
proxy.config.ssl.server. private_key.path	STRING	/config	Specifies the private key path for the server certificate.
proxy.config.ssl.CA. cert.filename	STRING	NULL	Specifies the name of the file containing the list of CAs that Content Gateway will accept from a client. When the connection is from the client to Content Gateway and the value of proxy.config. ssl.client.certification_level is 1 or 2, Content Gateway sends the CA list to client.
proxy.config.ssl.CA. cert.path	STRING	NULL	Specifies the path to the CA list files. See the preceding entry.
proxy.config.ssl.client.cert. policy	INT	1	For SSL certificate incidents, specifies whether to tunnel an incident (0), or block the request and create an entry in the incident list (1).
proxy.config.ssl.client.verify. server	INT	0	Enables (1) or disables the Certificate Verification Engine (CVE). See Validating certificates.
proxy.config.ssl.cert. verify.denycnmismatch	INT	1	Enables (1) or disables the CVE check: "Deny certificates where the common name does not match the URL" The setting applies only when the CVE is enabled.
proxy.config.ssl.cert. verify.allowcnwild	INT	1	Enables (1) or disables the CVE check: "Allow wildcard certificates" The setting applies only when the CVE is enabled.
proxy.config.ssl.cert. verify.denyexpired	INT	1	Enables (1) or disables the CVE check: "No expired or not yet valid certificates" The setting applies only when the CVE is enabled.
proxy.config.ssl.cert. verify.certchain	INT	1	Enables (1) or disables the CVE check: "Verify entire certificate chain" The setting applies only when the CVE is enabled.
proxy.config.ssl.cert. verify.checkcrl	INT	1	Enables (1) or disables the CVE check: "Check certificate revocation by CRL" The setting applies only when the CVE is enabled.
proxy.config.ssl.cert. verify.checkocsp	INT	0	Enables (1) or disables the CVE check: "Check certificate revocation by OCSP" The setting applies only when the CVE is enabled.
proxy.config.ssl.cert. verify.blockunknownocsp	INT	0	Enables (1) or disables the CVE check: "Block certificates with Unknown OCSP state" The setting applies only when the CVE is enabled.
proxy.config.ssl.cert. verify.denymd5cert	INT	0	Enables (1) denial of certificates that use an MD5 signiture.
proxy.config.ssl.cert. verify.revprefer	INT	1	Specifies the preferred method for the certificate revocation check. 1 = CRL 2 = OCSP
proxy.config.ssl.cert. verify.blocknouri	INT	0	Enables (1) or disables the CVE check: "Block certificates with no CRL URI and with no OCSP URI"
proxy.config.ssl.cert. verify.bypassfail INT 0	INT	0	Enables (1) the certificate check failure bypass option that allows users to proceed to a site after the certificate check has failed.
proxy.config.ssl.cert. verify.bypasscache	INT	1	Enables (1) the verification timeout cache.
proxy.config.ssl.cert. verify. bypasscachetimeout	INT	6	Specifies the time, in seconds, that an entry in verification bypass cache times out and is purged.
proxy.config. ssl_decryption_bypass. tunnel_non-ssl_traffic	INT	0	Enables (1) or disables (0) tunneling of non-ssl traffic. This variable must be added manually.