3.1. Procedure – Configuring one-sided SSL

Purpose: 

To disable encryption on one side of the connection for an existing Encryption Policy that is configured to handle HTTPS connections, complete the following steps.

Steps: 

1. Navigate to Zorp > Proxies, and select the proxy to be modified, or create a new one (for example, OnesidedHttpsProxy).

2. • To disable encryption on the client side, add the self.ssl.client_connection_security parameter to the Changed config attributes panel, then set it to const_ssl_none.

   • To disable encryption on the server side, add the self.ssl.server_connection_security parameter to the Changed config attributes panel, then set it to const_ssl_none.

   Python: Add one of the following lines to proxy:

   self.ssl.server_connection_security = SSL_NONE
   self.ssl.client_connection_security = SSL_NONE

3. When Zorp is used to protect the servers, you must deploy the certificate of the server (including its private key) to Zorp, so that Zorp can show the certificate to the clients that connect to the server. The proxy used in the connection must be configured to use this certificate when communicating with the clients. Complete the following steps.

   1. Import the certificate of the server into ZMS, and set the firewall to be its owner host. For details, see Procedure 11.3.8.6, Importing certificates in Zorp Professional 7 Administrator Guide.

   2. Navigate to Zorp > Proxies, and select the proxy to be modified (for example, OnesidedHttpsProxy).

   3. Select (or add, if not already present) the self.ssl.server_keypair_files parameter, then click Edit.

   4. A window showing the certificates available on the host appears. Select the certificate of the server.

      Note
      The list displays only the certificates where the firewall host is set as the owner host of the certificate (that is, both the certificate and its private key is available).