Using Certificates in HTTPS Clusters
Using Certificates in HTTPS Clusters
The HTTPS protocol supports encrypted, secure communication between clients and servers. It
requires that a Secure Sockets Layer (SSL) authentication handshake occur between a client and a
server in order for a connection request to succeed.
When a client requests an HTTPS connection to a web server, the server (which has already been
set up to support SSL connections) sends a server certificate to the client for verification. The
client checks the content of the certificate against a local database of Certificate Authorities, and
if it finds a match the connection is made. If no match is found (as is often the case with self-
signed certificates), the browser will display a warning and ask if you want to continue with the
connection.
A further level of trust can be enabled by setting the server up to request a client certificate in
addition to the server certificate. Copies of the client certificate are pre-installed on both client
and server. When the server sends the server certificate to the client, it also sends a request for a
certificate from the client. Once the client accepts the server certificate as described above, it
sends the client certificate to the server for verification. The server compares the client certificate
it receives with its local copy of the client certificate, and if they match the connection is made.
Each Layer 7 HTTPS cluster requires a server certificate; client certificates are optional.
Web servers (such as Apache) and browsers (such as Internet Explorer and Firefox) are delivered
with pre-installed Trusted Root Certificates. Trusted Root Certificates are used to validate the
server and client certificates that are exchanged when an HTTPS connection is established.
Equalizer supports self-signed certificates, as well as signed certificates from Trusted Root
Certificate Authorities and from Certificate Authorities (CAs) without their own Trusted Root CA
certificates. If a CA without its own Trusted Root CA certificate issues your certificate, you will
need to install at least two certificates: a server certificate and a chained root (or intermediate)
certificate for the CA. The intermediate certificate associates the server certificate with a Trusted
Root certificate.
806
Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.
Содержание Equalizer GX Series
Страница 18: ......
Страница 32: ...Overview 32 Copyright 2014 Coyote Point Systems A Subsidiary of Fortinet Inc ...
Страница 42: ......
Страница 52: ......
Страница 64: ......
Страница 72: ......
Страница 76: ......
Страница 123: ...Copyright 2014 Coyote Point Systems A Subsidiary of Fortinet Inc All Rights Reserved 123 Equalizer Administration Guide ...
Страница 228: ......
Страница 238: ......
Страница 411: ...Copyright 2014 Coyote Point Systems A Subsidiary of Fortinet Inc All Rights Reserved 411 Equalizer Administration Guide ...
Страница 459: ...Copyright 2014 Coyote Point Systems A Subsidiary of Fortinet Inc All Rights Reserved 459 Equalizer Administration Guide ...
Страница 476: ......
Страница 492: ......
Страница 530: ......
Страница 614: ......
Страница 626: ......
Страница 638: ......
Страница 678: ......
Страница 732: ...Using SNMP Traps 732 Copyright 2014 Coyote Point Systems A Subsidiary of Fortinet Inc ...
Страница 754: ......
Страница 790: ......
Страница 804: ......
Страница 842: ......
Страница 847: ...Copyright 2014 Coyote Point Systems A Subsidiary of Fortinet Inc All Rights Reserved 847 Equalizer Administration Guide ...
Страница 866: ......