topic Firepower 4110 ssl decryption supported certificates in Network Security

Firepower 4110 ssl decryption supported certificates

praveen-dharmaraj — Fri, 21 Feb 2020 15:56:38 GMT

Dear all ,

i am planning to buy SSL certificate for the Firepower IPS model 4110 .

SSL certificate is for using https deep inspection .

My FMC version : 6.2.3.83 .

which type of certificate i have to buy , i can see lot of types in the public ca sites . please guide .

Thanks ,

Praveen

Re: Firepower 4110 ssl decryption supported certificates

Rob Ingram — Wed, 04 Jul 2018 08:22:37 GMT

Hi, You cannot use any public CA to sign a certificate for SSL decryption. SSL Decryption is basically performing a MITM attack and impersonating the website's certificate, a public CA would therefore not grant such a certificate.

The certificate you require has to be issued from a local CA and the template used should be a "Subordinate Certificate Authority" template. All client computers must have the root certificate in it's certificate store in order to not receive any certificate errors.

HTH

Re: Firepower 4110 ssl decryption supported certificates

praveen-dharmaraj — Wed, 04 Jul 2018 13:09:42 GMT

Thank you RJI.