Inspect TLS traffic

Enable Advanced TLS traffic inspection

• Removes the need to configure TLS credentials manually
• Supports more ciphers than SSL inspection, including Perfect Forward Secrecy (PFS) ciphers

Use Advanced TLS traffic inspection to inspect traffic

• IIS
• Microsoft Exchange
• Remote Desktop Protocol (RDP)

Note If you need to inspect TLS traffic that is not supported by Advanced TLS traffic inspection, or TLS traffic on other operating systems, you can configure the legacy SSL inspection instead.

Configure SSL inspection (legacy)

1. In the Server & Workload Protection console, select the computer to configure and click Details to open the computer editor.
2. In the left pane of the computer editor, click Intrusion Prevention → Advanced → View SSL Configurations, and click View SSL Configurations to open the SSL computer Configurations window.
3. Click New to open the SSL Configuration wizard.
4. Specify the interface to which to apply the configuration on this computer:
   • To apply to all interfaces on this computer, select All Interface(s).
   • To apply to specific interfaces, select Specific Interface(s).
5. Select Port(s) or Ports List and select a list, then click Next.
6. On the IP Selection screen, select All IPs or provide a Specific IP on which to perform SSL inspection, then click Next.
7. On the Credentials screen, select how to provide the credentials:
   • I will upload credentials now
   • The credentials are on the computer

     Note The credential file must include the private key.

8. If you chose the option to upload credentials now, enter their type, location, and pass phrase (if required). If the credentials are on the computer, provide Credential Details.
   • If you are using PEM or PKCS#12 credential formats stored on the computer, identify the location of the credential file and the file's pass phrase (if required).
   • If you are using Windows CryptoAPI credentials, choose the credentials from the list of credentials found on the computer.
9. Provide a name and description for this configuration.
10. Review the summary and close the SSL Configuration Wizard. Read the summary of the configuration operation and click Finish to close the wizard.

Change port settings

1. Go to Intrusion Prevention Rules in the computer's Details window to see the list of Intrusion Prevention rules being applied on this computer.
2. Sort the rules by Application Type and locate the "Web Server Common" application type. (You can perform these changes to similar application types as well.)
3. Right-click a rule in the application type and click Application Type Properties.
4. Override the inherited "HTTP" Port List so that you include the port you defined during the SSL Configuration setup as well as port 80. Enter the ports as comma-separated values. For example, if you use port 9090 in the SSL configuration, enter 9090, 80.
5. To improve performance, on the Configuration tab, deselect Inherited and Monitor responses from Web Server.
6. Click OK to close the dialog.

Use Intrusion Prevention when traffic is encrypted with Perfect Forward Secrecy (PFS)

Note Using the Advanced TLS traffic inspection feature, the Intrusion Prevention module will be able to analyze traffic encrypted with PFS ciphers without additional configuration.

1. Use Perfect Forward Secrecy for TLS traffic between the Internet and your load balancer (or reverse proxy).
2. Terminate the Perfect Forward Secrecy session at your load balancer (or reverse proxy).
3. Use a non-PFS cipher suite (see SSL inspection supports the following cipher suites below) for traffic between the load balancer (or reverse proxy) and the web server or application server, so that the Intrusion Prevention module on the server can decrypt the TLS sessions and inspect them.
4. Restrict traffic to the web server for application server ports that do not use Perfect Forward Secrecy.

Special considerations for Diffie-Hellman ciphers

Note This section only applies when using SSL inspection instead of Advanced TLS traffic inspection.

1. Open the server's configuration file. The file name and location of web server configuration files vary by operating system (OS) and distribution. For example, the path could be:
   • Default installation on RHEL4: /etc/httpd/conf.d/ssl.conf
   • Apache 2.2.2 on Red Hat Linux: /apache2/conf/extra/httpd-ssl.conf
2. In the configuration file, find the "SSLCipherSuite" variable.
3. Add !DH:!EDH:!ADH: to these fields, if this string does not already appear. (The "!" tells Apache to "not" use this cipher.)
4. For example, you might edit the Apache configuration file's cipher suite to look like this:

SSLCipherSuite !DH:!EDH:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

Supported cipher suites

Supported protocols

• TLS 1.0
• TLS 1.1
• TLS 1.2