Configuring Virtual Ssl Servers For An Ssl Proxy List - Cisco 11503 - CSS Content Services Switch Configuration Manual

Configuring Virtual SSL Servers for an SSL Proxy List

Configuring Virtual SSL Servers for an SSL Proxy List
Note
Cisco Content Services Switch SSL Configuration Guide
4-4
This section discusses creating one or more virtual SSL servers for an SSL proxy
list. Use the ssl-server command to define an index entry in the SSL proxy list
that you then use to configure specific SSL parameters associated with the SSL
proxy list. An SSL module in the CSS uses the virtual SSL servers to properly
process and terminate SSL communications between the client and the server. You
must define an ssl-server index number before configuring SSL proxy list
parameters. You can define a maximum of 256 virtual SSL servers for a single
SSL proxy list.
For example, suppose the e-commerce vendor Brand New Products, Inc. wants to
configure the CSS to perform SSL termination. They need to divert all traffic
intended for https://www.brandnewproducts.com to the SSL module in the CSS.
To do this, they must identify a VIP address for a virtual SSL server in the SSL
proxy list and link the list to the same VIP address as a content rule. The VIP
address requires the following additional SSL configuration parameters:
Identification of a virtual TCP port number that corresponds with a content
•
rule
An existing RSA or DSA certificate for identification purposes
•
An appropriate SSL key pair to perform encryption and signing (assuming
•
you are using an RSA key pair)
Diffie-Hellman parameters if your CSS SSL security requires the
•
Diffie-Hellman key exchange algorithm
Assignment of a cipher suite
•
You cannot modify the virtual SSL servers in an active SSL proxy list. You must
first suspend the SSL proxy list to make modifications to any of the virtual SSL
servers in a specific SSL proxy list. Once you have modified the SSL proxy list,
suspend the SSL service, activate the SSL proxy list, and then activate the SSL
service.
Chapter 4 Configuring SSL Termination
OL-5655-01