Install a subordinate certificate authority (CA) for HTTPS inspection
Create and install a subordinate CA so that you can use one certificate across all your XG Firewall appliances for SSL/TLS scanning.
Introduction
You can use your own certificate with both the DPI engine and when using XG Firewall as a direct web proxy. The configuration steps are as follows:
- Generate a certificate signing request (CSR).
- Sign the CSR.
- Convert the signed CA.
- Upload the signed CA to XG Firewall.
- Upload the root CA to XG Firewall.
- Configure the HTTPS scanning CA when using the DPI engine.
- Configure the HTTPS scanning CA when using XG Firewall as a direct web proxy.
- Confirm the new certificate is used for web traffic.
Generate a certificate signing request (CSR)
When you send the CSR to a certificate authority, the CA will issue a certificate based on these details.
-
For Action, select
Generate certificate signing request (CSR).
The option to generate the CSR on XG Firewall is shown below.
-
Specify the certificate details.
Name
Description
Name
Enter a name.
Valid until
Specify the certificate’s validity period.
Key type
Select from the following:
- RSA
- Elliptic curve
Key length
If you’ve set the key type to RSA, select the key length. It's the number of bits used to construct the key.
Larger keys offer greater security, but it takes longer to encrypt and decrypt data.
Curve name
If you’ve set the key type to Elliptic curve, select the curve name.
Do not select secp521r1 for websites and the XG Firewall web admin console. A version of Google Chrome does not support the curve on certain operating systems.
Secure hash
Select the algorithm from the list.
Key encryption
Select key encryption if you want to encrypt the private key.
Passphrase/PSK
If you select key encryption, enter a passphrase or a pre-shared key and reconfirm.
Certificate ID
Select the type of certificate ID to identify the device and specify the ID.
- DNS: Enter the domain name. The name must resolve to the IP address in the DNS records.
- IP address: Use this if you want to use a public IP address that you own.
- Email: Email address of the contact person.
- DER ASN1 DN [X.509]: Use this if you want a digital certificate.
Example certificate detail data is shown below, you will need to enter details for your own domain.
-
Specify the following identification attributes:
Name
Description
Country name
Country in which the device is deployed.
State
The state within the country.
Locality name
Name of the city.
Organization name
Name of the certificate owner. Example: Sophos Group
Organization unit name
Name of the department to which the certificate will be assigned. Example: marketing
Common name
Common name or FQDN. Example: marketing.sophos.com
Email address
Contact person’s email address.
Example ID attributes are shown below, you will need to enter details for your own organization.
-
Download the CSR using the download button.
The download button is highlighted below.
Your downloaded CSR package should include the:
- CSR in .csr format.
- Private key in .key format.
- Password in .txt format.
The contents of the CSR are shown below, your own file names will match those entered in the certificate details section previously.
Sign the CSR
You need to create a new certificate that is signed by your root CA certificate.
-
Sign in to the Microsoft certificate server and select Request a
certificate.
The option is highlighted below.
-
Select Advanced certificate request.
The option is highlighted below.
-
Open the CSR file you downloaded from XG Firewall, and
copy the complete content without any extra lines. Select Subordinate Certification
Authority for your template.
The area to paste the CSR content and the correct menu option are highlighted below.
-
Download the certificate in DER encoded format.
The file format and download option are highlighted below.
The downloaded certificate file will look this:
-
Download the root CA you used to sign the certificate.
The download option is highlighted below.
Upload the signed CA to XG Firewall
You need to upload the signed CA to XG Firewall to use it for HTTPS scanning.
-
Enter the following information:
Option Description Name
Enter a name for the certificate.
Certificate file format
Choose the format that matches the certificate.
Certificate
Click Browse and select the certificate file.
Private key
Click Browse and select the private key file downloaded as part of the CSR file. The private key is the .key file.
CA Passphrase
Enter the passphrase you used when creating the CSR. This can be found in the Password.txt file downloaded as part of the CSR package.
The options you should choose are shown below, however your own file names will be different and should match what was specified when you created the CSR.
Upload the root CA to XG Firewall
To use the recently uploaded signed CA, you must also add its root CA to XG Firewall.
-
For Certificate, click
Browse and select your root CA.
The options you should choose are shown below, however your own file names will be different and should match the CA you download from the certificate server.
Configure the HTTPS scanning CA when using the DPI engine
You need to configure HTTPS decryption and scanning to use your recently signed CA.
-
Under the Re-signing certificate authorities section, select the recently signed
CA for Re-sign RSA with.
The menu options are shown below. The certificate you choose should match the one you uploaded previously.
Configure the HTTPS scanning CA when not using the DPI engine for web traffic scanning
-
Under the HTTPS decryption and scanning section, select the recently signed
CA for HTTPS scanning certificate authority (CA).
The menu options are shown below, the certificate you choose should match the one you uploaded previously.
Confirm the correct certificate is being used for web traffic
-
Select Certificate Path.
An example certificate path is shown below.
You should see your newly signed CA being used and the root CA used to sign the subordinate CA.