▶ BLOG

KB No. 2753: SSL DECRYPTION: INTEGRATING THE AUTHORITY CERTIFICATE

KB OLFEO On-Premise
June 5, 2023

How to use the certificate and key issued by the certification authority to perform SSL decryption

 

BACKGROUND

To decrypt SSL traffic from HTTPS pages, SSL decryption configuration is required. This module requires a "Trusted Root Certification Authority" type certificate.

If you have a certification authority, you can extract the certificate and key to use in this process. This authority certificate will create signatures to encrypt traffic between the Olfeo web security gateway and the client.

Note: if you do not have a certification authority, you can generate a self-signed certificate that must be deployed via GPO in the "Trusted Root Certification Authorities" store on client workstations. See this article for information on creating the certificate: https://support.olfeo.com/kb/article/2723

 

STEPS

Connect to the MS Windows server that has the Active Directory Certificate Services role.

Open Server Manager, click Tools, and then select Certification Authority:

In the new window that appears, right-click on your certificate authority, select All Tasks, then Save Certificate Authority...:

The Certificate Authority Backup Wizard appears. Click Next.

In the next step, check the Private Key and Certificate Authority Certificate option, then specify the location of the files by clicking Browse ...:

In the next step, do not enter a password and click Next:

WARNING! 

Please note that certificates protected by a password or passphrase are not supported.

 

Click Finish to complete the operation.

You will receive a PKCS12 file (with the .P12 extension) containing your authority's certificate and private key:

In order to import these elements into the Olfeo web security gateway, you must extract the contents of this file. To do this, you can use various tools depending on the operating system you have available:

  • XCA (Microsoft Windows)
  • openssl (Linux)

XCA (Microsoft Windows)

Download and install the XCA tool:https://sourceforge.net/projects/xca/files/xca/1.3.2/setup_xca-1.3.2.exe/download

Create a new database by clicking File then New Database:

In the new window that appears, specify a location for the database (.xdb file) and enter a password, then click OK.

Click on the Import menu and select PKCS#12:

Specify the location of the file with the .P12 extension.

In the new window that appears, click Import All:

To export the private key, click the Private Keys tab, select the key, and click Export.

Save the file in PEM format (*.pem):

WARNING! 

Be careful to change the default file location; an error message will appear if you do not customize this field.

 

Repeat the same operation in the Certificates tab :

openssl (Linux)

To export the private key, run the following command:
openssl pkcs12 -in file.p12 -nocerts -out private.key

Example:

To export the certificate, run the following command:
openssl pkcs12 -in file_name.p12 -clcerts -nokeys -out public.crt

Example:

CERTIFICATE MANAGEMENT IN OLFEO

To import these elements into the SSL decryption configuration, go to the Proxy Cache QoS menu and click on the Global SSL Options tab.

Import the certificate and private key on this page, then click the Validate button.