Web Gateway 7.1.5 Product Guide - McAfee

Block untrusted certificate authorities
Web filtering
SSL scanning 6
SSL.Server.FirstKnownCAIsTrusted equals false –> Block
The rule blocks a certificate chain if the first known CA that was found is not trusted. The settings
in the property specify a list for the module that checks the certificate authorities.
The action settings specify a message to the requesting user.
Verify Common Name (proxy setup)
This nested rule set verifies set the common name in a certificate. It applies only to requests sent in
non-transparent mode.
Nested library rule set — Verify Common Name (proxy setup)
Criteria — Connection.SSL.TransparentCNHandling equals false
Cycle — Requests (and IM)
The rule criteria specifies that the rule set applies if a request is received through a connection used in
SSL-secured communication and verification of the common name is not performed in transparent
mode.
The rule set contains the following rules:
Allow matching hostname
URL.Host equals Certificate.SSL.CN –> Stop Rule Set
The rule allows a request if the URL of the requested host is the same as the common name in the
certificate.
Allow wildcard certificates
Certificate.SSL.CN.HasWildcards equals true AND
URL.Host matches.Certificate.SSL.CN.ToRegex(Certificate.SSL.CN) –> Stop Rule Set
The rule allows requests to hosts sending certificates that have wildcards in their common names
matching the URLs of the hosts. To verify that a common name containing wildcards matches a
host, this name is converted into a regular expression.
Allow alternative common names
URL.Host is in list Certificate.SSL.AlternativeCNs –> Stop Rule Set
The rule allows requests to hosts with alternative common names in their certificates and the host
matches at least one of them.
Block incident
Always –> Block
If any of the rules for allowing matching common names applies, processing of the rule set stops
and this rule is not processed. Otherwise, requests are blocked by this rule due to a common name
mismatch. The action settings specify a message to the requesting user.
McAfee Web Gateway 7.1.5 Product Guide 219