How HTTPS scanning works in cisco asa

[contactvatsalshah]

Hello,

Very eager to know about how HTTPS works on CISCO ASA with firepower subscription?

can anyone please tell me how cisco asa scan HTTPS packets and block web categories applied by admin? Does it use certificate or something else?

[Karsten Iwen]

FirePower gets a certificate that has to be trusted by your clients or come from an internal trusted CA.

When the client connects to a HTTPS-ressource (can also be other services that work with TLS), then FP issues a new certificate on the fly with the subject of the destination server. With that it makes itself a Man-in-the-middle and can inspect the data.

In general, it's the same as probably all HTTP-inspecting gateways work.

[contactvatsalshah]

Thanks for clearing my doubts. 

Is there any document for details description of HTTPS inspecting about Cisco firepower?

[Karsten Iwen]

The config guide shows it in much detail:

http://www.cisco.com/c/en/us/td/docs/security/firepower/610/configuration/guide/fpmc-config-guide-v61/understanding_traffic_decryption.html