Web Gateway 7.1.5 Product Guide - McAfee

Web filtering
SSL scanning 6
SSL Client Context engine settings
You can configure the SSL Client Context engine settings. These are the settings for the module that
deals with the certificates the appliance sends to its clients.
Note: These settings can be configured on the Settings tab of the Policy top-level menu.
Default CA
Settings for the SSL Client Context module when it uses a certificate issued by the default root
certificate authority (root CA)
Define SSL Client Context
Settings for the SSL Client Context module
(Current root certificate authority) — Parameters and values of the root certificate authority (root CA)
that is currently in use on the appliance
After the initial setup, a default root CA is implemented on the appliance. For further administration, it
is recommended that you create your own root CA. Use the Generate New button to create this
certificate authority.
Send certificate chain — When selected, the appliance sends information on the chain of
certificates that are involved in the process of validating the certificate the appliance sends to its
clients
The certificate the appliance sends as a server to its clients is considered to exist on level 0. When a
certificate authority (CA) signs this server certificate to validate it, it is done on level 1. When an
additional certificate authority validates the first certificate authority, it is done on level 2. With each
additional certificate authority that is involved, the level increases by one.
When a certificate authority validates another certificate authority, it issues and signs a certificate for
this authority. However, instead of being validated by another certificate authority, a certificate
authority can also validate itself by issuing and signing a certificate. This certificate is then called a
self-signed certificate.
The certificates involved in the validating process are said to form a certificate chain. In the simplest
case, a certificate chain has only two members: the certificate the appliance sends as a server to its
clients and the self-signed certificate of the certificate authority that signed the server certificate on
level 1. The certificate authority that stands at the beginning of the validating process is known as the
root certificate authority (root CA).
Information on a certificate chain includes data on all the certificate authorities involved. The appliance
needs to send this information to its clients if not all of these certificate authorities are known and
trusted by the clients.
Certificate chain — Input field for entering information on a certificate chain
After importing an existing certificate authority (CA) that is involved in a certificate chain, the
information on this certificate chain appears in the field.
Perform insecure renegotations — When selected, the module renegotiates the parameters for
the SSL-secured communication even if this is insecure to do
Client cipher list — String of Open SSL symbols used for decrypting client data
SSL session cache TTL — Time (in seconds) for keeping the parameter values of a session in
SSL-secured communication stored in the cache
SSL protocol version — Version of the protocol the SSL Scanner module follows when it performs a
handshake
• TLS 1.0 — When selected, TLS (Transport Layer Security) version 1.0 is used
• SSL 3.0 — When selected, SSL version 3.0 is used
For more information on how to create a new certificate authority or import an existing certificate
authority for use instead of the default one, see Create your own certificate authority and Import a
certificate authority.
McAfee Web Gateway 7.1.5 Product Guide 225