SSL Decryption for ASA 5516x with firepower

[charles_nana]

Hi,

Is it possible to configure SSL decryption to inspect the traffic using 3rd party certificate ? I aim having 6 different AD trees behind this firewall with about 500 users. 

Also is this unit good enough support SSL decryption? 

Thanks

Charles

[Bogdan Nita · Accepted solution]

You can use 3rd party certificate for SSL decryption on the firepower.

SSL decryption on an ASA with firepower can have a performance decrease of up to 80%, because it is done in software.

The new Firepower models 4100 and 9000 do it in hardware and should have a much better performance.

[charles_nana]

Thank you for your reply.

[Karsten Iwen]

What do you mean with 3rd party? It can *not* be done with a certificate that you purchase from a public CA. You need a certificate that has the basic constraints set so that you can issue certificates. You only get this with a self-signed certificate or from a private CA. In both cases, the local self-signed or the private root-certificate needs to be trusted by the clients. These certificates are completely unrelated to your AD.

[Bogdan Nita]

Hi Karsten,

Thank you for pointing that out. I usually hear 3rd party certificate when referring to certificates issued by private CAs and my above answer was based on that.

[charles_nana]

Hi,

What I wanted to know was whether I can use a certificate purchased from a CA like Godaddy. As I don't want to maintain a CA in house.

Thanks

Charles

[Karsten Iwen]

As already mentioned: No, you can't!

[Bogdan Nita]

Public CAs, like Godaddy will not sign certificates that can be used in man in the middle SSL decryption.

The options for certificates used for SSL decryption are self-signed or enterprise CA-signed certificate.

Sorry for misunderstanding your original question.

[charles_nana]

Hi Bogdan,

Thanks for your reply. If I have to use self-signed or enterprise CA-signed certificate, those will not be trusted by the non-domain devices like phones and tablets. Any suggestions on how to deliver these certificates to non-domain devices?

[Karsten Iwen]

That is typically done with the mobile device management.