topic Re: SSL Decryption for ASA 5516x with firepower in Network Security

SSL Decryption for ASA 5516x with firepower

charles_nana — Fri, 21 Feb 2020 14:56:22 GMT

Hi,

Is it possible to configure SSL decryption to inspect the traffic using 3rd party certificate ? I aim having 6 different AD trees behind this firewall with about 500 users.

Also is this unit good enough support SSL decryption?

Thanks

Charles

Re: SSL Decryption for ASA 5516x with firepower

Bogdan Nita — Mon, 11 Dec 2017 16:11:31 GMT

You can use 3rd party certificate for SSL decryption on the firepower.

SSL decryption on an ASA with firepower can have a performance decrease of up to 80%, because it is done in software.

The new Firepower models 4100 and 9000 do it in hardware and should have a much better performance.

Re: SSL Decryption for ASA 5516x with firepower

charles_nana — Mon, 11 Dec 2017 16:16:20 GMT

Thank you for your reply.

Re: SSL Decryption for ASA 5516x with firepower

Karsten Iwen — Mon, 11 Dec 2017 19:00:30 GMT

What do you mean with 3rd party? It can *not* be done with a certificate that you purchase from a public CA. You need a certificate that has the basic constraints set so that you can issue certificates. You only get this with a self-signed certificate or from a private CA. In both cases, the local self-signed or the private root-certificate needs to be trusted by the clients. These certificates are completely unrelated to your AD.

Re: SSL Decryption for ASA 5516x with firepower

Bogdan Nita — Tue, 12 Dec 2017 10:20:41 GMT

Hi Karsten,

Thank you for pointing that out. I usually hear 3rd party certificate when referring to certificates issued by private CAs and my above answer was based on that.

Re: SSL Decryption for ASA 5516x with firepower

charles_nana — Tue, 12 Dec 2017 14:15:09 GMT

Hi,

What I wanted to know was whether I can use a certificate purchased from a CA like Godaddy. As I don't want to maintain a CA in house.

Thanks

Charles

Re: SSL Decryption for ASA 5516x with firepower

Karsten Iwen — Tue, 12 Dec 2017 14:27:35 GMT

As already mentioned: No, you can't!

Re: SSL Decryption for ASA 5516x with firepower

Bogdan Nita — Tue, 12 Dec 2017 14:46:18 GMT

Public CAs, like Godaddy will not sign certificates that can be used in man in the middle SSL decryption.

The options for certificates used for SSL decryption are self-signed or enterprise CA-signed certificate.

Sorry for misunderstanding your original question.

Re: SSL Decryption for ASA 5516x with firepower

charles_nana — Tue, 12 Dec 2017 17:58:15 GMT

Hi Bogdan,

Thanks for your reply. If I have to use self-signed or enterprise CA-signed certificate, those will not be trusted by the non-domain devices like phones and tablets. Any suggestions on how to deliver these certificates to non-domain devices?

Re: SSL Decryption for ASA 5516x with firepower

Karsten Iwen — Tue, 12 Dec 2017 18:12:54 GMT

That is typically done with the mobile device management.