SSL Forward Proxy (Man in the Middle)
Resolution
SSL Forward Proxy
When a Palo Alto Networks firewall is configured for SSL Forward Proxy, it decrypts HTTPS traffic between internal users and external websites so it can inspect the traffic for threats.
Instead of allowing the client to connect directly to the website, the firewall intercepts the HTTPS connection and generates a certificate for the requested website. This creates a secure connection between the client and the firewall.
The firewall then establishes a second secure connection to the actual web server. Since the firewall sits between these two encrypted connections, it can decrypt the traffic, inspect it using the configured security profiles, and then re-encrypt it before forwarding it to the destination. This is why SSL Forward Proxy is often described as a trusted Man-in-the-Middle (MITM).
Important Considerations
- Certificate Validity
- The certificate generated by the firewall uses the same validity period as the original web server certificate.
- Forward Trust Certificate
- The generated certificate is signed by the firewall's Forward Trust certificate.
- The Forward Trust certificate must be installed and trusted on client devices. Otherwise, the browser will display a certificate warning.
- Forward Untrust Certificate
-
- If the web server presents an invalid, expired, or untrusted certificate, the firewall signs the generated certificate using the Forward Untrust certificate.
- This ensures the user's browser continues to display a certificate warning instead of hiding the certificate issue.
owner: swhyte