Cisco Cisco Web Security Appliance S670 User Guide

Click Edit Settings.

For each type of certificate error, define the proxy response. 

For more information about handling invalid server certificates, see 

.

Submit and commit changes.

To determine whether the issuing certificate authority has revoked a certificate, the Web Security 
appliance can check with the issuing certificate authority in these ways:

Expired

The current date falls outside of the range of validity for the 
certificate.

Mismatched hostname

The hostname in the certificate does not match the 
hostname the client was trying to access. This might 
happen during a “man in the middle attack,” or when 
a server redirects a request to a different URL. For 
example, http://mail.google.com gets redirected to 
http://www.gmail.com.The Web Proxy can only 
perform hostname match when it is deployed in 
explicit forward mode. When it is deployed in 
transparent mode, it does not know the hostname of 
the destination server (it only knows the IP address), 
so it cannot compare it to the hostname in the server 
certificate.

Unrecognized root authority/issuer

Either the root authority or an intermediate certificate 
authority is unrecognized.

Invalid  signing  certificate

There was a problem with the signing certificate, for example, 
a failure to verify or decrypt the signature.

Invalid leaf certificate

There was a problem with the leaf certificate, for example, a 
rejection, decoding, or mismatch problem.

All other error types

Most other error types are due to the appliance not being able 
to complete the SSL handshake with the HTTPS server. For 
more information about additional error scenarios for server 
certificates, see 
http://www.openssl.org/docs/apps/verify.html.

Drop

Drop the connection. 

Decrypt

Decrypt the content and apply access policies as if this was an 
HTTP connection.

Monitor

Do not take determinative action based on this certificate 
error. Continue validation services.