4.1. Procedure – Configuring Server Name Indication (SNI)

Purpose: 

To configure an HttpProxy in a name-based virtual hosting scenario that uses Server Name Indication (SNI) to determine the address of the target server, complete the following steps.

Steps: 

1. Create and configure an Encryption Policy. Complete the following steps.

   1. Navigate to the Zorp ZMC component of the firewall host.

   2. Select Policies > New.

   3. Enter a name into the Policy name field, for example, MySNIEncryption.

   4. Select Policy type > Encryption Policy, then click OK.

      

      Figure 9. Creating an Encryption policy

   5. Select Class > TwoSidedEncryption.

      

      Figure 10. Configuring the Encryption policy

      Python:

      EncryptionPolicy(
          name="MySNIEncryption",
          encryption=TwoSidedEncryption()
          )

2. Double-click client_certificate_generator, then select Class > SNIBasedCertificate.

   

   Figure 11. Configuring the certificate

3. Double-click default and click New to add a certificate entry to a list of certificates.

   

   Figure 12. Creating a new certificate entry

4. Select the default certificate. Zorp will show this certificate to the clients when none of the other configured certificates match the client request.

   Python:

       encryption=TwoSidedEncryption(
           client_certificate_generator=SNIBasedCertificate(
               default=StaticCertificate(
                   certificates=(
                       Certificate.fromFile(
                           certificate_file_path="/etc/key.d/ZMS_Engine/cert.pem",
                           private_key=PrivateKey.fromFile(
                               "/etc/key.d/ZMS_Engine/key.pem")),
                   )
               )
           )
       )

5. Configure a mapping that describes to which hostname the list of certificates belongs to. For each certificate, configure a Matcher Policy. If this policy matches the domain name in the client SNI request, Zorp shows the associated certificate to the client. Any type of matcher policy can be used here, but in most scenarios only RegexpMatcher policies will be needed. (For details on Matcher Policies, see Section 6.7.4, Matcher policies in Zorp Professional 7 Administrator Guide.)

   The following example configures two matchers and two certificates, one for the myfirstdomain.example.com domain, one for the myseconddomain.example.com domain. Complete the following steps:

   1. Double-click hostname_certificate_map, then click New.

   2. Select Class > RegexpMatcher.

   3. Click Match > New, then enter the domain name (for example, myfirstdomain.example.com) into the Expression field. Click OK.

      

      Figure 13. Configuring the hostname-certificate mapping

   4. Click Edit and click New to add a certificate entry to a list of certificates.

      

      Figure 14. Creating a new certificate entry

   5. Double-click certificate_file_path and select the certificate to show if a client tries to access the domain set in the previous step.

   6. Click Select, then click OK.

   7. Click OK to close the list editor.

      

      Figure 15. Configuring the hostname-certificate mapping

   8. Repeat from Step 'a' to Step 'e' for the myseconddomain.example.com domain and its respective certificate.

   Python:

       encryption=TwoSidedEncryption(
           client_certificate_generator=SNIBasedCertificate(
               default=StaticCertificate(
                   certificates=(
                       Certificate.fromFile(
                           certificate_file_path="/etc/key.d/ZMS_Engine/cert.pem",
                           private_key=PrivateKey.fromFile(
                               "/etc/key.d/ZMS_Engine/key.pem")),
                   )),
               hostname_certificate_map={
                   RegexpMatcher(
                       match_list=("myfirstdomain.example.com", )): StaticCertificate(
                           certificates=(
                               Certificate.fromFile(
                                   certificate_file_path="/etc/key.d/myfirstdomain/cert.pem",
                                   private_key=PrivateKey.fromFile(
                                       "/etc/key.d/myfirstdomain/key.pem")),
                           )),
                   RegexpMatcher(
                       match_list=("myseconddomain.example.com", )): StaticCertificate(
                           certificates=(
                               Certificate.fromFile(
                                   certificate_file_path="/etc/key.d/myseconddomain/cert.pem",
                                   private_key=PrivateKey.fromFile(
                                       "/etc/key.d/myseconddomain/key.pem")),
                           ))
                   },
           )
       )

6. Configure the other options of the Encryption Policy as needed for your environment.

7. Create a service and a firewall rule that uses this new Encryption Policy and an HttpProxy class.

   Python:

   def demo() :
       Service(
           name='demo/inter_HttpSNIService',
           router=TransparentRouter(),
           chainer=ConnectChainer(),
           proxy_class=HttpProxy,
           max_instances=0,
           max_sessions=0,
           keepalive=Z_KEEPALIVE_NONE,
           encryption_policy="MySNIEncryption"
       )
   
       Rule(
           rule_id=300,
           src_subnet=('internet', ),
           dst_zone=('dmz', ),
           proto=6,
           service='demo/inter_HttpSNIService'
       )