NETGEAR STM150 Reference Manual page 71

ProSecure Web/Email Threat Manager STM150 Reference Manual
the way SSL works. The STM150 generated certificate has the same name and expiration date of
the original certificate sent by the server. However, since the certificate was generated by the
STM150 and not a trusted certificate authority, the browser will notify the user that the certificate
is not valid. To prevent these popups, you must add NETGEAR as a trusted root CA in your
browser.
If client authentication is required, the STM150 may not be able to scan the HTTPS traffic in some
cases due to the nature of SSL. SSL has two parts – client and server authentication. Server
authentication occurs with every HTTPS request, but client authentication is NOT mandatory, and
rarely occurs. As a result, whether the request is from the STM150 or the real client is of less
importance.
However, certain HTTPS servers do require client certificate authentication for every HTTPS
request. By the design of SSL, the client needs to present its own certificate rather than using the
one from the STM150. The HTTPS scanning process will be affected because of this.
Optimizing Scans 4-21
v1.0, January 2009