Web Gateway 7.1.5 Product Guide - McAfee

6
Web filtering
SSL scanning
Create your own certificate authority
This section describes a procedure for creating a certificate authority (CA) of your own for use instead
of the certificate authority that is implemented on the appliance after the initial setup.
To create a certificate authority:
1 Go to Policy | Settings.
2 On the Engines branch of the settings tree, go to SSL Client Context with CA and select the
settings you want to configure, for example, Default.
3 Click Generate New. The Generate New Certificate Authority Window opens.
4 In the Organization and Locality fields, type suitable information for your own certificate authority.
5 [Optional] In the Organizational unit and State fields, type suitable information. From the
Country list, select a country.
6 In the Common name field, type a common name for your own certificate authority.
7 [Optional] In the Email address field, type an email address of your organization.
8 From the Valid for list, select the time that your certificate authority should be valid.
9 [Optional] In the Comment field, type a plain-text comment on the certificate authority.
10 Click OK. The new certificate authority is generated.
11 Click Save Changes.
The certificate authority you created through this procedure is the one that signs the certificate the
appliance sends to its clients in the starting phase of the SSL-secured communication.
For information on other settings for the communication between the appliance and its clients, see SSL
Client Context engine settings.
Import a certificate authority
This section describes a procedure for importing an existing certificate authority (CA) for use instead of
the certificate authority that is implemented on the appliance after the initial setup.
To import a certificate authority:
1 Go to Policy | Settings.
2 On the Engines branch of the settings tree, go to SSL Client Context with CA and select the
settings you want to configure, for example, Default.
3 Click Import. The Import Certificate Authority Window opens.
4 In the the Certificate field, enter the name of the file that contains the data for the certificate
authority you want to import. To do this, click the Browse button and browse to a suitable file.
The file must be encoded in PEM (Privacy-enhanced mail) format.
5 In the the Private key field, enter the name of the file that contains the key the certificate authority
uses for signing certificates. To do this, click the Browse button and browse to a suitable file.
The file must be encoded in PEM format. The key must have a length of at least 2048 bit.
6 [Conditional] If the private key is protected by a password, type it in the Password field.
Note: Only unencrypted keys and key that are AES-128-bit encrypted can be used here.
7 [Conditional] If the certificate authority is involved in a certificate chain and you want to retrieve
information on this chain to let the appliance send it to its clients with a certificate, enter the name
of the file that contains the information in the Certificate chain field. To do this, click the Browse
button and browse to a suitable file.
The file must be encoded in PEM format.
226 McAfee Web Gateway 7.1.5 Product Guide