ASA capable of SSL offloading?

bsisco · ‎12-12-2007

It was suggested to me that the ASA (5510 v.7.2(2)) was capable of offloading SSL encryption (like a proxy might do).

The intention is to take port 443 SSL traffic and decrypt using a certificate on the ASA then pass the unencrypted port 80 traffic back to the webserver.

Thanks!

richf · ‎12-12-2007

I have not heard of the ASA doing that type of SSL offloading. I think that the person was thinking about SSL VPN where the traffic past the ASA would be unencrypted. My recommendation for SSL offloading for web servers would be a CSS. the 11501 is cheap, robust, and offers SSL offloading. You can also configure it to use a weaker cipher strength on the backend so it is still encrypted but only at 40 or 56 bit.

For the scanning of SSL traffic I have not heard of the ASA being able to do it yet but I suspect if they do not do it now they eventually will. That would involve decrypting the traffic on the ASA, scanning it for malicious traffic, and then reencrypting it for the rest of the path. These methods usually involve the middle device (in this case the ASA) issuing a self signed cert to you and intercepting the public cert from the target site. The traffic will not flow past the ASA unencrypted.

If I am mistaken on the abilities of the ASA I would like to know.