Integrated SSL Scanning
Page 8 Finjan proprietary and confidential
2.4.1 Validating the HTTPS Server’s Certificate
When the Vital Security Scanning Server acts as an HTTPS client and
retrieves the secured content from the HTTPS server, the first thing it does
is validate the SSL certificate. If the certificate includes the AIA extension,
Vital Security will follow the link and will validate the certificate of the
issuer of the certificate.
2.4.2 Replying to the User with AIA Extension
When the Integrated SSL Scanning module acts as the SSL server, it can
also reply to the end-users with the AIA extension. In organizations which
employ their own root CA server, it is possible to create a root CA
certificate with AIA already inside. During the handshake with the client,
Vital Security sends the end-user the server’s certificate and a chain,
which includes (in addition to the certificate) the root CA certificate with the
AIA field present.
This way the browser analyzes the server’s certificate first and the signing
certificate second, where it will find the AIA extension which allows it to
continue the verification with the signing certificate of the organization.
2.5 SSL Certificate Errors
When the end-user opens the HTTPS session, the Scanning Server must
encrypt and decrypt the data between the end-user and the Scanning
Server. The Scanning Server uses the certificate it already generated (as
described above). As the certificate is self-signed by Finjan, and is not
trusted by the end-user’s browser, the user will receive a warning
message:
Figure 3: Internet Explorer Warning Message
To Next Page
Loading...
Need help?
General
