Table of Contents
Advertisement
Chapter 3 SSL Introduction
3
SSL INTRODUCTION
This chapter presents a short introduction to basic SSL components and a description of
how the components are used in configuring the SonicWALL SSL appliance. Instructions for
using OpenSSL to generate keys and certificates is also included in this chapter.
Introduction to SSL
Secure Socket Layer (SSL) is an application-level protocol that enables secure transactions
of data through privacy, authentication, and data integrity. It relies upon certificates, public
keys, and private keys.
Certificates are similar to digital ID cards. They prove the identity of the server to clients.
®
Certificates are issued by Certificate Authorities (CAs) such as VeriSign
or Thawte. Each
certificate includes the name of the authority that issued it, the name of the entity to which
the certificate was issued, the entity's public key, and time stamps that indicate the
certificate's expiration date.
Public and private keys are the ciphers used to encrypt and decrypt information. While the
public key is shared quite freely, the private key is never given out. Each public-private key
pair works together: data encrypted with the public key can only be decrypted with the
private key.
You can configure SonicWALL SSL appliances using either the GUI or command line
interface-based QuickStart wizard or configuration manager. The latter options are
available remotely or through serial or telnet connections.
Port Blocking Mechanism
During configuration you must specify the SSL and clear text (decrypted) TCP service ports.
SonicWALL SSL appliances monitor the SSL TCP service port(s) you specify, perform SSL
decoding of packets on those ports, then send the packets to the server via a user-defined
TCP clear text service port. All other network traffic is passed through the appliance
transparently.
The clear text TCP service port used for data transfer between the SSL appliance and the
web server cannot be used for any other data. The SSL appliance blocks access to the clear
text port, protecting your secure data from direct clear test access.
One result of this port blocking strategy is that you cannot use the same plain text TCP
service port between the SSL appliance and the server for both non-secure (http:) and
Page 25
Advertisement
Table of Contents
