3.2.4.1. Procedure – Enabling SSL-encryption in the connection

Purpose: 

To proxy HTTPS connections, you have to configure an Encryption Policy to handle SSL/TLS connections, and use this Encryption Policy in your Service. The policy will be configured to:

Steps: 

1. Generate a certificate for your firewall. The Application-level Gateway component requires its own certificate and keypair to perform SSL/TLS proxying.

   MC: Create a certificate, set the firewall as the owner host of the certificate, then distribute it to the firewall host. For details, see Chapter 11, Key and certificate management in PNS in Proxedo Network Security Suite 1.0 Administrator Guide.

   Python: In configurations managed manually from python, create an X.509 certificate (with its related keypair) using a suitable software (for example, OpenSSL) and deploy it to the PNS firewall host (for example, copy it to the /etc/key.d/mycert folder).

2. Create and configure an Encryption Policy. Complete the following steps.

   1. Navigate to the Application-level Gateway MC component of the firewall host.

   2. Select Policies > New.

   3. Enter a name into the Policy name field, for example, MyTLSEncryption.

      

      Figure 3.1. Creating a new Encryption policy

   4. Select Policy type > Encryption Policy, then click OK.

   5. Select Class > TwoSidedEncryption.

      Python:

      EncryptionPolicy(
          name="MyTLSEncryption",
          encryption=TwoSidedEncryption()
          )

   6. 

      Figure 3.2. Selecting Encryption policy class

      Double-click client_certificate_generator, then select Class > StaticCertificate.

   7. Double-click certificate, then double-click certificate_file_path. A window displaying the certificates owned by the host will be displayed. The lower section of the window shows the information contained in the certificate. Select the certificate that you want Application-level Gateway to show to the clients (for example, the certificate created in Step 1), then click Select.

      

      Figure 3.3. Creating a new Encryption policy

      Python:

          encryption=TwoSidedEncryption(
              client_certificate_generator=StaticCertificate(
                  certificate=Certificate.fromFile(
                      certificate_file_path="/etc/key.d/MS_Engine/cert.pem",
                      private_key=PrivateKey.fromFile(
                          "/etc/key.d/MS_Engine/key.pem")
                  )
              )
          )

   8. If the private key of the certificate is password-protected, double-click private_key_password, type the password, then click OK. Otherwise, click OK.

   9. Disable mutual authentication. That way, Application-level Gateway will not request a certificate from the clients.

      Double-click client_verify, select Class > ClientNoneVerifier, then click OK.

      

      Figure 3.4. Disabling mutual authentication

      Python:

          encryption=TwoSidedEncryption(
              client_verify=None
          )

   10. Specify the directory containing the certificates of the trusted CAs. These settings determine which servers can the clients access: the clients will be able to connect only those servers via SSL/TLS which have certificate signed by one of these CAs (or a lower level CA in the CA chain).

       Double-click server_verify, double-click ca_directory, then type the path and name to the directory that stores the trusted CA certificates, for example, /etc/ca.d/certs/. Click OK.

       

       Figure 3.5. Specifying trusted CAs

       Python:

           encryption=TwoSidedEncryption(
               server_verify=ServerCertificateVerifier(
                   ca_directory="/etc/ca.d/certs/"
               )
           )

       Note
       CAs cannot be referenced directly, only the trusted group containing them. For details on managing trusted groups, see Section 11.3.7.3, Managing trusted groups in Proxedo Network Security Suite 1.0 Administrator Guide.

   11. Specify the directory containing the CRLs of the trusted CAs.

       Double-click crl_directory, then type the path and name to the directory that stores the CRLs of the trusted CA certificates, for example, /etc/ca.d/crls/. Click OK.

       

       Figure 3.6. Specifying CRLs

       Python:

           encryption=TwoSidedEncryption(
               server_verify=ServerCertificateVerifier(
                   ca_directory="/etc/ca.d/certs/",
                   crl_directory="/etc/ca.d/crls/"
               )
           )

   12. Optional Step: The Common Name in the certificate of a server or webpage is usually its domain name or URL. By default, Application-level Gateway compares this Common Name to the actual domain name it receives from the server, and rejects the connection if they do not match. That way it is possible to detect several types of false certificates and prevent a number of phishing attacks. If this mode of operation interferes with your environment, and you cannot use certificates that have proper Common Names, disable this option.

       Double-click server_verify > check_subject, select FALSE, then click OK.

       Python:

           encryption=TwoSidedEncryption(
               server_verify=ServerCertificateVerifier(
                   ca_directory="/etc/ca.d/certs/",
                   crl_directory="/etc/ca.d/crls/",
                   check_subject=FALSE
               )
           )

   13. Optional Step: Forbid the use of weak encryption algorithms to increase security. The related parameters can be set separately for the client and the server-side of Application-level Gateway, using the client_ssl_options and server_ssl_options parameters of the Encryption Policy. Disabling weak algorithms also eliminates the risk of downgrade attacks, where the attacker modifies the SSL session-initiation messages to force using weak encryption that can be easily decrypted by a third party.

       Note
       Certain outdated operating systems, or old browser applications do not properly support strong encryption algorithms. If your clients use such systems or applications, you might have to permit weak encryption algorithms.

       1. Double-click client_ssl_options, click method, click , select const_ssl_method_tls1_1 or const_ssl_method_tlsv1_2, then click OK.

          Repeat this step for the server_ssl_options parameter.

       2. SSL methods may occasionally fall back to older (thus weaker) protocol versions if one of the peers does not support the newer version. To avoid this situation, explicitly disable undesired protocol versions (SSLv2 and SSLv3 are disabled by default).

          For example, to disable TLSv1, double-click client_ssl_options > disable_tlsv1, click TRUE, then click OK. Repeat this step for the server_ssl_options parameter.

       Python:

           encryption=TwoSidedEncryption(
               server_ssl_options=ServerSSLOptions(
                   method=SSL_METHOD_TLSV1_2, disable_proto_tlsv1=TRUE)
               client_ssl_options=ClientSSLOptions(
                   method=SSL_METHOD_TLSV1_2, disable_proto_tlsv1=TRUE)
               )

   14. Optional Step: Enable untrusted certificates. Since a significant number of servers use self-signed certificates (with unverifiable trustworthiness), in certain situations you might need to permit access to servers that have untrusted certificates.

       Double-click server_ssl_options > trusted, click FALSE, then click OK.

       Python:

           encryption=TwoSidedEncryption(
               server_verify=ServerCertificateVerifier(
                   trusted=FALSE
               )
           )

   Python:

   The Encryption Policy configured in the previous steps is summarized in the following code snippet.

   EncryptionPolicy(
       name="MyTLSEncryption",
       encryption=TwoSidedEncryption(
           client_verify=None,
           server_verify=ServerCertificateVerifier(
               ca_directory="/etc/ca.d/certs/",
               crl_directory="/etc/ca.d/crls/",
               check_subject=FALSE
               ),
           client_ssl_options=ServerSSLOptions(
               method=SSL_METHOD_TLSV1_2, disable_proto_tlsv1=TRUE),
           server_ssl_options=ServerSSLOptions(
               method=SSL_METHOD_TLSV1_2, disable_proto_tlsv1=TRUE),
           client_certificate_generator=StaticCertificate(
               certificate=Certificate.fromFile(
                   certificate_file_path="/etc/key.d/MS_Engine/cert.pem",
                   private_key=PrivateKey.fromFile(
                       "/etc/key.d/MS_Engine/key.pem")
               ))
           ))

3. Select PKI > Distribute Certificates.

   Note when managing PNS without MC, you must copy the certificates and CRLs to their respective directories. They are not updated automatically as in configurations managed by MC.

   By performing the above steps, you have configured the proxy to use the specified certificate and its private key, and also set the directory that will store the certificates of the trusted CAs and their CRLs. Client authentication has also been disabled.

4. Create a service that clients can use to access the Internet in a secure channel. This service will use the MyTLSEncryption Encryption Policy.

   1. Select Services > New, enter a name for the service (for example, intra_HTTPS_inter), then click OK.

   2. Select Proxy class > Http > HttpProxy.

   3. Select Encryption > MyTLSEncryption.

   4. Configure the other parameters of the service as needed for your environment, then click OK.

   5. Select Firewall Rules > New > Service, and select the service created in the previous step. For more details on creating firewall rules, see Section 6.5, Configuring firewall rules in Proxedo Network Security Suite 1.0 Administrator Guide.

   6. Configure the other parameters of the rule as needed for your environment, then click OK.

   

   Figure 3.7. Creating a Service

   Python:

   def demo() :
       Service(
           name='demo/intra_HTTPS_inter',
           router=TransparentRouter(),
           chainer=ConnectChainer(),
           proxy_class=HttpProxy,
           max_instances=0,
           max_sessions=0,
           keepalive=Z_KEEPALIVE_NONE,
           encryption_policy="MyTLSEncryption"
       )
   
       Rule(
           rule_id=300,
           src_subnet=('192.168.1.1/32', ),
           dst_zone=('internet', ),
           proto=6,
           service='demo/intra_HTTPS_inter'
       )

5. Commit and upload your changes, then restart Application-level Gateway.

   Expected result: 

   Every time a client connects to a server, Application-level Gateway checks the certificate of the server. If the signer CA is trusted, Application-level Gateway shows a trusted certificate to the client (browser or other application). If the certificate of the server is untrusted, Application-level Gateway shows an untrusted certificate to the client, giving a warning to the user. The user can then decide whether the certificate can be accepted or not.