Cisco Cisco Web Security Appliance S170 사용자 가이드

Use the following OpenSSL command to convert a DER formatted certificate file to a PEM formatted 
certificate file:

openssl x509 -inform DER -in 

 -outform PEM -out 

 

You can also convert key files in DER format into the PEM format by running a similar OpenSSL 
command. 

For RSA keys, use the following command:

openssl rsa -inform DER -in 

 -outform PEM -out 

 

For DSA keys, use the following command:

openssl dsa -inform DER -in 

 -outform PEM -out 

 

For more information about using OpenSSL, see the OpenSSL documentation, or visit  
http://openssl.org.

To monitor and decrypt HTTPS traffic, you must enable the HTTPS Proxy on the Security Services > 
HTTPS Proxy page. When you enable the HTTPS Proxy, you must configure what the appliance uses 
for a root certificate when it sends self-signed server certificates to the client applications on the 
network. You can upload a root certificate and key that your organization already has, or you can 
configure the appliance to generate a certificate and key with information you enter.

When AsyncOS for Web runs on a FIPS-compliant Web Security appliance, you must use the FIPS 
management console to generate or upload the root certificate and key pair. When you generate or upload 
certificates and keys using the FIPS management console, the keys are protected by the HSM card. For 
more information on using the FIPS management console, see 

Once the HTTPS Proxy is enabled, all HTTPS policy decisions are handled by Decryption Policies. You 
can no longer define Access and Routing Policy group membership by HTTPS, nor can you configure 
Access Policies to block HTTPS transactions. If some Access and Routing Policy group memberships 
are defined by HTTPS and if some Access Policies block HTTPS, then when you enable the HTTPS 
Proxy those Access and Routing Policy groups become disabled. You can choose to enable the policies 
at any time, but all HTTPS related configurations are removed. 

When you upload a certificate to the Web Security appliance, verify it is a signing certificate and not a 
server certificate. A server certificate cannot be used as a signing certificate, so decryption does not work 
when you upload a server certificate.

For more information about root certificates, see 

Also on this page, you can configure what the appliance does with HTTPS traffic when the server 
certificate is invalid.

For information on importing a custom root authority certificate, see 

To enable the HTTPS Proxy: