topic CSS11500 ssl-server authentication in Application Networking

CSS11500 ssl-server authentication

shday — Wed, 27 Mar 2013 15:52:08 GMT

I've read the docs regarding a solution for the SSL/TLS renegotiation vulnerability for the CSS devices and I have a question regarding the recommendation of using ssl-server authentication.

In the doc it states that with ssl-server authentication configured ssl connections will require the client to exchange a certificate during the ssl handshake process and that the CSS will verify the cert is valid. I'm trying to determine if the client certificate is an x.509 certificate, a standard CA the client would issue or is it change that the cert and key matches what I have configured in my ssl-proxy-list????

I have way to many clients to go back and work through a deployment for x.509 so if thats the case is there something else I can do to resolve this vulnerabilty.

CSS11500 ssl-server authentication

Kanwaljeet Singh — Thu, 28 Mar 2013 09:22:08 GMT

Hi,

Client certs are also x.509 type certs and would be issued by CA. Client authentication is also optional and is used by server to confirm the identity of client to which it is talking to.

Which vulnerability are you referreing to and in which version?

As far as i know client authentication adds an extra parameter of security but is optional.

Regards,

Kanwal

CSS11500 ssl-server authentication

Jorge Bejarano — Thu, 28 Mar 2013 21:09:51 GMT

What version are you running?

Jorge

CSS11500 ssl-server authentication

shday — Wed, 03 Apr 2013 17:48:32 GMT

sg0810401 (08.10.4.01)

The vulnerability is

topic CSS11500 ssl-server authentication in Application Networking

CSS11500 ssl-server authentication

CSS11500 ssl-server authentication

CSS11500 ssl-server authentication

CSS11500 ssl-server authentication

Advisory ID: cisco-sa-20091109-tls