Cisco Cisco Web Security Appliance S670 User Guide

openssl rsa -inform DER -in 

 -outform PEM -out 

 

For DSA keys, use the following command:

openssl dsa -inform DER -in 

 -outform PEM -out 

 

For more information about using OpenSSL, see the OpenSSL documentation, or 
visit 

 

http://openssl.org.

To monitor and decrypt HTTPS traffic, you must enable the HTTPS Proxy on the 
Security Services > HTTPS Proxy page. When you enable the HTTPS Proxy, you 
must configure what the appliance uses for a root certificate when it sends 
self-signed server certificates to the client applications on the network. You can 
upload a root certificate and key that your organization already has, or you can 
configure the appliance to generate a certificate and key with information you 
enter.

Once the HTTPS Proxy is enabled, all HTTPS policy decisions are handled by 
Decryption Policies. You can no longer define Access and Routing Policy group 
membership by HTTPS, nor can you configure Access Policies to block HTTPS 
transactions. If some Access and Routing Policy group memberships are defined 
by HTTPS and if some Access Policies block HTTPS, then when you enable the 
HTTPS Proxy those Access and Routing Policy groups become disabled. You can 
choose to enable the policies at any time, but all HTTPS related configurations are 
removed. 

When you upload a certificate to the Web Security appliance, verify it is a signing 
certificate and not a server certificate. A server certificate cannot be used as a 
signing certificate, so decryption does not work when you upload a server 
certificate.

For more information about root certificates, see