Noob Query - Does the ASA55xx & AIP SSM support HTTPS or SSL inspection?

[andrewboggs]

So far, all I can find on the ASA is an Application Inspection Match Criteria for the HTTP CONNECT request that carries you into the world of HTTPS (SSL).  Vendors who can inspect SSL generally brag about it and have to devote at least one chapter in the User Guide to Certificate Management and Key Rings.  Right now I am guessing that unless the Ingress traffic is from an SSL VPN Client, there isn't going to be much inspection going on.  THX

[Jennifer Halim · Accepted solution]

The reason why there isn't much on HTTPS inspection is because the device needs to be performing man-in-the-middle to be able to inspect the HTTPS encrypted traffic. Typically vendor that inspects for HTTPS traffic would have the device certificate presented to the user in order to be able to inspect the HTTPS traffic, not the end web server certificate.

Both Cisco Ironport WSA and Cisco ScanSafe supports inspection of HTTPS web traffic for anti malware, anti spyware and web filtering.

Hope that answers your question.

[andrewboggs]

Thanks for the pointers on IronPort WSA and ScanSafe.  This customer's scenario is inbound to their SSL Web Server and they are under the impression that the AIP-SSM is doing IPS inside of the SSL stream to that Web Server.  With no Man-In-The-Middle and no Keyring, I am afraid the best they can hope for is header checks during the SSL negotiations.  I like to double check before I deliver bad news.  THX.