WEBVTT

1
00:00.000 --> 00:00.770 align:middle line:84%


2
00:00.770 --> 00:03.470 align:middle line:90%
In order to play the
game of TLS decryption

3
00:03.470 --> 00:05.900 align:middle line:90%
on the web security appliance,
the web security plans

4
00:05.900 --> 00:08.210 align:middle line:90%
needs to have a signed
certificate, an identity

5
00:08.210 --> 00:10.440 align:middle line:90%
certificate that they can
use with all the clients.

6
00:10.440 --> 00:12.230 align:middle line:90%
So if you're using
PKI, that's great.

7
00:12.230 --> 00:15.440 align:middle line:90%
Most the browsers are
set to trust those CAs

8
00:15.440 --> 00:17.700 align:middle line:90%
as part of the PKI, the
public key infrastructure.

9
00:17.700 --> 00:21.110 align:middle line:90%
But if we're using an
enterprise CA server in-house,

10
00:21.110 --> 00:24.320 align:middle line:90%
we want to do is make sure that
our website appliance trusted

11
00:24.320 --> 00:27.470 align:middle line:90%
that Root Certificate server
and also had a signed identity

12
00:27.470 --> 00:29.840 align:middle line:90%
certificate on it, because
it's going to be interacting

13
00:29.840 --> 00:31.033 align:middle line:84%
with all of our clients.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

13
00:29.840 --> 00:31.033 align:middle line:84%
with all of our clients.

14
00:31.033 --> 00:33.200 align:middle line:90%
So what I like to do is
walk you through the process

15
00:33.200 --> 00:36.560 align:middle line:90%
of prepping the web security
appliance with an identity

16
00:36.560 --> 00:38.990 align:middle line:90%
certificate and the
enterprise Root Certificate

17
00:38.990 --> 00:41.240 align:middle line:90%
so we can actually do
the decryption of TLS

18
00:41.240 --> 00:44.520 align:middle line:90%
and have it be virtually
transparent to our clients.

19
00:44.520 --> 00:47.420 align:middle line:90%
So our first step would be to
train the WSA, the web security

20
00:47.420 --> 00:50.750 align:middle line:90%
appliance that it trusts, our
enterprise root certificate

21
00:50.750 --> 00:51.300 align:middle line:84%
server.

22
00:51.300 --> 00:52.958 align:middle line:90%
And to do that, we
can go to Network.

23
00:52.958 --> 00:54.500 align:middle line:90%
And under network,
we have the option

24
00:54.500 --> 00:55.800 align:middle line:84%
for certificate management.

25
00:55.800 --> 00:56.630 align:middle line:84%
So we click that.

26
00:56.630 --> 00:58.838 align:middle line:90%
And right here is saying
under Certificate Management

27
00:58.838 --> 01:01.790 align:middle line:90%
that there's like 250
certificates in the Cisco
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.838 --> 01:01.790 align:middle line:90%
that there's like 250
certificates in the Cisco

28
01:01.790 --> 01:03.440 align:middle line:84%
Trusted Root Certificate List.

29
01:03.440 --> 01:06.140 align:middle line:90%
And to see or modify
that list, we simply

30
01:06.140 --> 01:09.597 align:middle line:90%
click on Manage Trusted Root
Certificates right here.

31
01:09.597 --> 01:11.930 align:middle line:90%
And as we take a look at the
list, sorted alphabetically

32
01:11.930 --> 01:14.570 align:middle line:90%
with all the CA servers
that are currently trusted,

33
01:14.570 --> 01:17.660 align:middle line:90%
if we want to import our
enterprise Root Certificate

34
01:17.660 --> 01:20.930 align:middle line:90%
as a trusted CA, we simply
go ahead and click on Import,

35
01:20.930 --> 01:21.920 align:middle line:84%
right here.

36
01:21.920 --> 01:23.570 align:middle line:90%
And here it's asking
us to simply grab

37
01:23.570 --> 01:25.260 align:middle line:84%
the file so we can import it.

38
01:25.260 --> 01:28.190 align:middle line:90%
So in Microsoft, if we go
to our Microsoft CA server,

39
01:28.190 --> 01:30.650 align:middle line:90%
if that's what we're using,
I just happen to have one
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:28.190 --> 01:30.650 align:middle line:90%
if that's what we're using,
I just happen to have one

40
01:30.650 --> 01:35.390 align:middle line:84%
at 192.168.1.117/serve.

41
01:35.390 --> 01:37.790 align:middle line:90%
And is where you can just
download the CA certificate

42
01:37.790 --> 01:38.460 align:middle line:84%
right here.

43
01:38.460 --> 01:40.010 align:middle line:90%
So you specify the
format you want,

44
01:40.010 --> 01:42.170 align:middle line:90%
click on Download
CA certificate,

45
01:42.170 --> 01:43.250 align:middle line:84%
say you want to keep it.

46
01:43.250 --> 01:45.080 align:middle line:90%
And then boom, you
have that certificate

47
01:45.080 --> 01:46.157 align:middle line:84%
on your file system.

48
01:46.157 --> 01:47.990 align:middle line:90%
Then we go back to the
web secure appliance,

49
01:47.990 --> 01:49.620 align:middle line:90%
and we click on
Choose File here.

50
01:49.620 --> 01:51.120 align:middle line:90%
We then go ahead
and grab that file.

51
01:51.120 --> 01:56.090 align:middle line:90%
So I save these all into a
folder I call it CA-Cert.cer.

52
01:56.090 --> 01:58.940 align:middle line:90%
So we select that file
and then click on Submit.

53
01:58.940 --> 02:02.360 align:middle line:90%
That'll go ahead and import
it as a Trusted Root CA.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:58.940 --> 02:02.360 align:middle line:90%
That'll go ahead and import
it as a Trusted Root CA.

54
02:02.360 --> 02:04.430 align:middle line:84%
So there it is in our list.

55
02:04.430 --> 02:06.315 align:middle line:90%
We'll go ahead and
click on Submit here.

56
02:06.315 --> 02:07.940 align:middle line:90%
And that takes us
back to the main page

57
02:07.940 --> 02:09.065 align:middle line:84%
for certificate management.

58
02:09.065 --> 02:10.892 align:middle line:90%
And then we'll click
on Commit Changes.

59
02:10.892 --> 02:12.350 align:middle line:90%
And then we can
add a comment if we

60
02:12.350 --> 02:14.640 align:middle line:90%
want to document what we
did during that change.

61
02:14.640 --> 02:17.570 align:middle line:90%
So now here on the Network and
Certificate Management page,

62
02:17.570 --> 02:18.987 align:middle line:90%
which we're looking
at right here,

63
02:18.987 --> 02:21.815 align:middle line:90%
it shows us that we have 250
certificates in Cisco Trusted

64
02:21.815 --> 02:24.260 align:middle line:90%
Root Certificate List and
one custom certificate.

65
02:24.260 --> 02:26.690 align:middle line:90%
And that's the one we just
added from our CA server

66
02:26.690 --> 02:28.350 align:middle line:84%
in our enterprise.

67
02:28.350 --> 02:30.110 align:middle line:90%
So that would be a
certificate authority
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:28.350 --> 02:30.110 align:middle line:90%
So that would be a
certificate authority

68
02:30.110 --> 02:33.680 align:middle line:90%
that all of our clients
internally also already trust.

69
02:33.680 --> 02:35.870 align:middle line:90%
So from the WSA's
perspective, we now

70
02:35.870 --> 02:38.660 align:middle line:90%
have a Root Certificate from
the enterprise that's trusted.

71
02:38.660 --> 02:41.720 align:middle line:90%
But we also need a signed
identity certificate,

72
02:41.720 --> 02:44.720 align:middle line:90%
signed by that CA, for the
web security appliance.

73
02:44.720 --> 02:46.580 align:middle line:90%
Let me show you exactly
how to do that too.

74
02:46.580 --> 02:49.160 align:middle line:90%
To get the identity certificate
on this website security

75
02:49.160 --> 02:51.200 align:middle line:90%
appliance signed by the
CA that we just added,

76
02:51.200 --> 02:53.360 align:middle line:90%
we'd go over to
Security Services.

77
02:53.360 --> 02:57.440 align:middle line:90%
And under Proxy Settings,
we'd go down to HTTPS Proxy,

78
02:57.440 --> 02:58.250 align:middle line:84%
right here.

79
02:58.250 --> 03:00.960 align:middle line:90%
By default, HTTPS
proxy is disabled.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

79
02:58.250 --> 03:00.960 align:middle line:90%
By default, HTTPS
proxy is disabled.

80
03:00.960 --> 03:03.840 align:middle line:90%
So we'll click on Enable and
Edit Settings right here.

81
03:03.840 --> 03:05.390 align:middle line:90%
And if this happens
be the first time

82
03:05.390 --> 03:08.090 align:middle line:90%
that we're enabling this feature
on this website appliance,

83
03:08.090 --> 03:10.140 align:middle line:90%
it's going to have a
little pop-up that says,

84
03:10.140 --> 03:11.473 align:middle line:84%
do you agree to all these terms?

85
03:11.473 --> 03:12.740 align:middle line:84%
Yes, click on Yes to continue.

86
03:12.740 --> 03:14.660 align:middle line:90%
I already agreed
to that previously.

87
03:14.660 --> 03:17.340 align:middle line:90%
And here asking for
the HTTPS Proxy,

88
03:17.340 --> 03:18.840 align:middle line:90%
what certificate
do you want to use?

89
03:18.840 --> 03:20.840 align:middle line:90%
Now I did a test run of
this a few minutes ago.

90
03:20.840 --> 03:23.090 align:middle line:90%
So I'm going to go ahead and
repeat that process here.

91
03:23.090 --> 03:26.180 align:middle line:90%
I'm going to specify that I want
to generate a new certificate

92
03:26.180 --> 03:29.120 align:middle line:90%
and key for my
identity certificate.

93
03:29.120 --> 03:31.640 align:middle line:90%
So I will go ahead and give
this the name of wsa.ogit.com.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

93
03:29.120 --> 03:31.640 align:middle line:90%
So I will go ahead and give
this the name of wsa.ogit.com.

94
03:31.640 --> 03:35.110 align:middle line:84%


95
03:35.110 --> 03:37.340 align:middle line:90%
And we'll call the
organization ogit

96
03:37.340 --> 03:38.900 align:middle line:90%
and the organizational
unit, call it

97
03:38.900 --> 03:40.790 align:middle line:84%
IT, country United States.

98
03:40.790 --> 03:42.680 align:middle line:90%
And let's say it's
good for 10 months.

99
03:42.680 --> 03:45.740 align:middle line:90%
That's more than enough
time for my lab environment

100
03:45.740 --> 03:47.160 align:middle line:84%
for the next few weeks.

101
03:47.160 --> 03:48.475 align:middle line:84%
And then we can Generate.

102
03:48.475 --> 03:49.100 align:middle line:84%
It says, Skeet!

103
03:49.100 --> 03:49.670 align:middle line:84%
I don't like it.

104
03:49.670 --> 03:51.020 align:middle line:90%
The country code has
to be upper case.

105
03:51.020 --> 03:52.562 align:middle line:90%
All right, we'll do
it one more time.

106
03:52.562 --> 03:53.120 align:middle line:84%
So Generate.

107
03:53.120 --> 03:55.400 align:middle line:84%
And we'll go ahead and do US.

108
03:55.400 --> 03:57.020 align:middle line:84%
And then click on Generate.

109
03:57.020 --> 03:58.910 align:middle line:90%
All right, so now
that is generated,

110
03:58.910 --> 04:01.730 align:middle line:90%
we now go ahead and download
that certificate signing
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
03:58.910 --> 04:01.730 align:middle line:90%
we now go ahead and download
that certificate signing

111
04:01.730 --> 04:02.820 align:middle line:84%
request.

112
04:02.820 --> 04:06.060 align:middle line:90%
So click on Download Certificate
Signing Request or CSR.

113
04:06.060 --> 04:08.480 align:middle line:90%
And I just renamed and moved
it from my Downloads folder.

114
04:08.480 --> 04:12.058 align:middle line:90%
So I just called
it WSA-CSR2.pem.

115
04:12.058 --> 04:13.850 align:middle line:90%
And that's our certificate
signing request.

116
04:13.850 --> 04:15.090 align:middle line:84%
And if we open that up--

117
04:15.090 --> 04:17.510 align:middle line:90%
So let's open it
up with Notepad.

118
04:17.510 --> 04:18.860 align:middle line:84%
So here's the contents of that.

119
04:18.860 --> 04:21.470 align:middle line:90%
If I take that and just do
a Control+A and a Control+C

120
04:21.470 --> 04:24.380 align:middle line:90%
to put my clipboard, I can
then go back to our CA server,

121
04:24.380 --> 04:28.220 align:middle line:90%
just go back to the Root folder
for Certificate Services here.

122
04:28.220 --> 04:30.260 align:middle line:90%
And say, I want to
request a certificate.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:28.220 --> 04:30.260 align:middle line:90%
And say, I want to
request a certificate.

123
04:30.260 --> 04:32.870 align:middle line:90%
And then we go ahead and do an
advanced certificate request.

124
04:32.870 --> 04:34.700 align:middle line:90%
And this interface may look
slightly different based

125
04:34.700 --> 04:36.290 align:middle line:90%
on the flavor of
Windows Server if you're

126
04:36.290 --> 04:37.430 align:middle line:84%
using a different platform.

127
04:37.430 --> 04:40.370 align:middle line:90%
But I'm still going to
paste in here, the CSR.

128
04:40.370 --> 04:41.720 align:middle line:84%
And then click on Submit.

129
04:41.720 --> 04:44.240 align:middle line:90%
And what I did was I
configured CA my services

130
04:44.240 --> 04:46.430 align:middle line:90%
to automatically issue
the certificate when

131
04:46.430 --> 04:47.185 align:middle line:84%
it was requested.

132
04:47.185 --> 04:49.310 align:middle line:90%
That way it doesn't have
to have a manual approval.

133
04:49.310 --> 04:51.470 align:middle line:90%
And then we'll simply
download that certificate.

134
04:51.470 --> 04:54.800 align:middle line:90%
So this is a certificate for the
web security appliance itself.

135
04:54.800 --> 04:57.765 align:middle line:90%
Its identity certificate
signed by our trusted CA.

136
04:57.765 --> 04:59.390 align:middle line:90%
So we'll click on
Download Certificate.

137
04:59.390 --> 05:00.515 align:middle line:84%
We'll click on Keep.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
04:59.390 --> 05:00.515 align:middle line:84%
We'll click on Keep.

138
05:00.515 --> 05:01.890 align:middle line:90%
So I went to my
Downloads folder,

139
05:01.890 --> 05:04.700 align:middle line:90%
renamed it to
WSA-ID-Cert2, not to be

140
05:04.700 --> 05:06.450 align:middle line:90%
confused with the
original one that I had.

141
05:06.450 --> 05:07.908 align:middle line:90%
And then we'll go
ahead and install

142
05:07.908 --> 05:11.590 align:middle line:90%
this as an identity certificate
on the web security appliance.

143
05:11.590 --> 05:14.010 align:middle line:90%
So to do that, let me
close my text editor there.

144
05:14.010 --> 05:15.990 align:middle line:90%
And now that we have an
identity certificate,

145
05:15.990 --> 05:18.700 align:middle line:90%
we'll go ahead and click
on Choose File right here.

146
05:18.700 --> 05:21.930 align:middle line:90%
And we'll take that
WSA-ID-Cert2 that

147
05:21.930 --> 05:24.583 align:middle line:90%
was just issued to us by
our certificate authority.

148
05:24.583 --> 05:27.000 align:middle line:90%
And once we've done that, we
can scroll down and make sure

149
05:27.000 --> 05:28.530 align:middle line:84%
these check boxes are on.

150
05:28.530 --> 05:30.930 align:middle line:90%
So Decrypt for
Application Detection,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

150
05:28.530 --> 05:30.930 align:middle line:90%
So Decrypt for
Application Detection,

151
05:30.930 --> 05:32.055 align:middle line:84%
Decrypt for Authentication.

152
05:32.055 --> 05:33.513 align:middle line:90%
Whatever features
you want on them,

153
05:33.513 --> 05:34.930 align:middle line:90%
go ahead and click
on right here.

154
05:34.930 --> 05:36.480 align:middle line:90%
And if you scroll
down a bit further,

155
05:36.480 --> 05:39.030 align:middle line:90%
it asks how we want to
handle invalid certificate

156
05:39.030 --> 05:41.130 align:middle line:90%
options from the
internet, if it's expired

157
05:41.130 --> 05:44.383 align:middle line:90%
or has a mismatched host name
or invalid signing certificate.

158
05:44.383 --> 05:45.300 align:middle line:84%
What do we want to do?

159
05:45.300 --> 05:47.050 align:middle line:90%
So you can pick
your pleasure there.

160
05:47.050 --> 05:49.485 align:middle line:90%
And if your CA server and
your enterprise supports OCSP,

161
05:49.485 --> 05:51.390 align:middle line:84%
you want to leave this enabled.

162
05:51.390 --> 05:53.100 align:middle line:90%
And that way you
can check online

163
05:53.100 --> 05:55.545 align:middle line:90%
for certificates that have
been revoked by that CA server.

164
05:55.545 --> 05:57.420 align:middle line:90%
My little CA server,
I'm not set up for that.

165
05:57.420 --> 05:58.962 align:middle line:90%
So I'm going to
leave that check off.

166
05:58.962 --> 06:00.420 align:middle line:84%
And then we'll click on Submit.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

166
05:58.962 --> 06:00.420 align:middle line:84%
And then we'll click on Submit.

167
06:00.420 --> 06:01.990 align:middle line:84%
And Continue.

168
06:01.990 --> 06:03.620 align:middle line:90%
So here is the
HTTPS proxy settings

169
06:03.620 --> 06:06.120 align:middle line:90%
that are enabled now, including
the certificate information.

170
06:06.120 --> 06:07.722 align:middle line:90%
And we'll click
on Commit Changes.

171
06:07.722 --> 06:09.930 align:middle line:90%
And if you want to leave a
comment, that's fantastic.

172
06:09.930 --> 06:11.125 align:middle line:84%
And we'll commit again.

173
06:11.125 --> 06:13.000 align:middle line:90%
So we've done two basic
things in this video.

174
06:13.000 --> 06:14.910 align:middle line:90%
We've installed a
Trusted Root Certificate.

175
06:14.910 --> 06:17.310 align:middle line:90%
And we've also installed
an identity certificate

176
06:17.310 --> 06:20.310 align:middle line:90%
on the website appliance
that's signed by that CA.

177
06:20.310 --> 06:22.680 align:middle line:84%
Now the next challenge is this.

178
06:22.680 --> 06:26.310 align:middle line:90%
Do we want to decrypt
everything that looks like TLS?

179
06:26.310 --> 06:27.780 align:middle line:84%
And the answer is no, we don't.

180
06:27.780 --> 06:29.850 align:middle line:90%
Because if a user
like Bob is going out

181
06:29.850 --> 06:32.070 align:middle line:90%
to his banking
website, we don't want
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

181
06:29.850 --> 06:32.070 align:middle line:90%
to his banking
website, we don't want

182
06:32.070 --> 06:34.860 align:middle line:90%
to decrypt that because we don't
want the liability of seeing

183
06:34.860 --> 06:37.740 align:middle line:90%
that traffic naked, including
passwords and other things

184
06:37.740 --> 06:39.250 align:middle line:84%
that he may be typing in.

185
06:39.250 --> 06:42.480 align:middle line:90%
So we'll take a look in the next
video at a decryption policy,

186
06:42.480 --> 06:45.030 align:middle line:90%
and how we can limit
what categories of sites

187
06:45.030 --> 06:47.460 align:middle line:90%
actually are going to be
decrypted by the web security

188
06:47.460 --> 06:48.068 align:middle line:84%
appliance.

189
06:48.068 --> 06:49.110 align:middle line:84%
So that's our next video.

190
06:49.110 --> 06:51.070 align:middle line:90%
And I'll see you there
in just a moment.

191
06:51.070 --> 06:53.460 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

192
06:53.460 --> 06:56.690 align:middle line:90%
And I'd like to thank
you for viewing.