background image

 

Integrated SSL Scanning 

 

Page 4 

Finjan proprietary and confidential 

2.2.2

 

Host cannot be Trusted  

Field 

Description 

Hostname does not match Certificate name 

The host name mismatches the 
one mentioned in the certificate. 

Cannot verify Hostname 

The host name is unavailable 
and therefore cannot be verified 
against the certificate. 

2.2.3

 

Bad Certificate Usage 

Field 

Description 

Unsupported certificate purpose 

The supplied certificate cannot 
be used for the specified 
purpose. 

Path length constraint exceeded 

The basic Constraints path 
length parameter has been 
exceeded. 

2.2.4

 

Invalid Security Structure 

Field 

Description 

Certificate signature cannot be decrypted 

The certificate signature could 
not be decrypted (meaningful for 
RSA keys). 

Cannot decode issuer public key 

The public key in the certificate 
SubjectPublicKeyInfo could not 
be read. 

2.2.5

 

 Certificate Cannot be Trusted 

Field 

Description 

Issuer certificate could not be found 

This occurs if the issuer 
certificate of an untrusted 
certificate cannot be found. 

Certificate signature failure 

The signature of the certificate 
is invalid. 

Certificate is self signed  

The certificate is self signed and 
the same certificate cannot be 
found in the list of trusted 
certificates. 

Root certificate could not be found locally 

The certificate chain could be 
built up using the untrusted 
certificates but the root could 
not be found locally. 

Summary of Contents for NG-5000

Page 1: ...Software Version 9 0 Integrated SSL Scanning...

Page 2: ...of Vulnerability are trademarks or registered trademarks of Finjan Sophos is a registered trademark of Sophos plc McAfee is a registered trademark of McAfee Inc Kaspersky is a registered trademark of...

Page 3: ...ts 1 Introduction 1 2 HTTPS Scanning 1 2 1 On the Fly Certificate Generation 1 2 2 Certificate Validation 2 2 3 SSL Certificate Errors 6 3 HTTPS Policies 11 4 Configuring HTTPS Support 11 4 1 HTTPS Co...

Page 4: ...injan also provides certificate validation functionality This ensures that corporate policies regarding certificates are enforced by automatically validating each certificate and ensuring that the cha...

Page 5: ...ital certificate lists are updated via Finjan security updates These lists include the required trusted certificate authorities as well as the Certificate Revocation Lists CRLs Certificate validation...

Page 6: ...means that the actual signature value could not be determined rather than it not matching the expected value CRL signature failure The signature of the certificate is invalid Certificate is not yet v...

Page 7: ...Structure Field Description Certificate signature cannot be decrypted The certificate signature could not be decrypted meaningful for RSA keys Cannot decode issuer public key The public key in the cer...

Page 8: ...rusted for the specified purpose Certificate rejected The root CA is marked to reject the specified purpose Subject issuer mismatch The current candidate issuer certificate was rejected because its su...

Page 9: ...e is before the current time 2 3 SSL Certificate Errors When the end user opens the HTTPS session the Scanning Server has to encrypt and decrypt the data between the end user and the Scanning Server T...

Page 10: ...ervers issued by the organization s CA root certificate which is already trusted by all users NOTE Using a certificate from a trusted CA such as VeriSign will not prevent the certificate validation ch...

Page 11: ...KiCKy JqpuLU0MuXsOOQ END CERTIFICATE 2 Install the certificate on the browser To install the certificate on Internet Explorer a In the control panel click Internet Options b Click the Content tab and...

Page 12: ...Copy this into a separate text file to send to a certificate authority 6 Once you have a certificate back send it to your end users to install on their browsers 7 In the Limited Shell enter the comma...

Page 13: ...dy configured to trust the organizations root CA and there is no need to configure anything for the users To install the root certificate on the Scanning Server 1 Connect to the Management Console via...

Page 14: ...In addition to the above two policies the user can configure additional policies and rules The security policies apply only to the way that the scanning server handles the certificate validation bypas...

Page 15: ...is disabled by default This protocol is non secure and should not be used unless there are compatibility problems Allow SSLv3 Enables support for SSLv3 protocol This option is enabled by default Allow...

Page 16: ...is timed out if not responsive Max HTTPS Transactions Backlog Defines the maximum number of outstanding connection requests to be served by the system After this number is reached the system is timed...

Page 17: ...to configure proxy settings for the users This can be done by using one of the following methods Layer 4 Switch By using a third party layer 4 switch it is possible to redirect all traffic destined to...

Page 18: ...still mandatory to install the SSL certificate of the Scanning Server on the end user s PC in order to prevent the security warnings When the end user browses an HTTPS site the Scanning Server generat...

Reviews: