Filter
Top Products
ProSecure Unified Threat Management (UTM) Appliance Reference Manual
6-34 Content Filtering and Optimizing Scans
v1.0, January 2010
HTTPS Scan Settings
HTTPS traffic is encrypted traffic that cannot be scanned otherwise the data stream would not be
secure. However, the UTM can scan HTTPS traffic that is transmitted through an HTTP proxy,
that is, HTTPS traffic is scanned as a proxy between the HTTPS client and the HTTPS server.
Figure 6-13 shows the HTTPS scanning traffic flow.
The HTTPS scanning process functions with the following principles:
• The UTM breaks up an SSL connection between an HTTPS server and an HTTP client in two
parts:
– A connection between the HTTPS client and the UTM.
– A connection between the UTM and the HTTPS server.
• The UTM simulates the HTTPS server communication to the HTTPS client, including the SSL
negotiation, certificate exchange, and certificate authentication. In effect, the UTM functions
as the HTTPS server for the HTTPS client.
• The UTM simulates the HTTPS client communication to the HTTPS server, including the SSL
negotiation, certificate exchange, and certificate authentication. In effect, the UTM functions
as the HTTPS client for the HTTPS server.
During SSL authentication, the HTTPS client authenticates three items:
• Is the certificate trusted?
• Has the certificate expired?
• Does the name on the certificate match that of the Web site?
Figure 6-13