10/10/25, 8:51 AM SSL Decryption Methods

Home / Symantec Security Software / Web and Network Security / SSL Visibility - 4.5 / SSL Decryption Methods

SSL Visibility 4.5

Version 4.5

Search this product 

SSL Decryption Methods

Last Updated April 7, 2025
Product Menu 
The SSL Visibility appliance supports two different methods for inspecting SSL. Each method requires that different information is
available to the SSL Visibility appliance.
Known server key mechanism relies on the SSL Visibility appliance having a copy of the SSL server's private key and certificate.
Certificate resign mechanism relies on the SSL Visibility appliance having a trusted or untrusted CA certificate that can be used to
sign SSL server certificates that have been intercepted and modified.
Both these methods can be used when the SSL Visibility appliance is operating in Active-Inline (Active-Inline Mode) or Passive-Inline
(Passive-Inline Mode) mode.

Note
The method used to inspect an SSL flow can be chosen based on the details related to that flow so it is possible for an SSL Visibility
appliance to be configured to use both mechanisms at the same time.

There are different variations of these two basic mechanisms that are used depending on the type of SSL session being decrypted, the
mode of operation of the SSL Visibility appliance and the type of certificates/keys available to the system. The different variations are
shown in detail in Policy Rulesets.

Known Server Key Method

When the SSL Visibility appliance is deployed using the Known Server Key method, the server certificate and key are installed on the
SSL Visibility appliance for every server that you want to inspect traffic to. This method can only be used where the SSL Visibility
appliance administrator has access to the server private key and certificate information; this is normally only the case if the SSL Visibility
appliance and the server are managed and operated by the same organization or enterprise, that is, for "inbound" traffic to "your"
internal servers.
Known Server Key Passive-Inline
In Passive-Inline mode, the SSL Visibility appliance is a MITM as the traffic between client and server passes through the SSL Visibility
appliance. The SSL Visibility appliance uses the server private key during the SSL handshake to negotiate a session key that is used to
encrypt and decrypt traffic carried over the session. SSL Visibility needs the server's private key and certificate so that it can appear to
be the real server; in other words, the client will authenticate the SSL Visibility appliance as being the server because the appliance can
respond to the handshake using the real server's private key.
An important point to note here is that there are now two different encrypted SSL sessions. The Client encrypts “abc” to “#$*” and sends
this out over the network. The SSL Visibility appliance can decrypt this to access the plaintext “abc.” The SSL Visibility appliance re-
encrypts the plaintext to produce “&!<,” and sends this over the network to the server which can decrypt it to access the plaintext “abc”.

[Link] 1/4
10/10/25, 8:51 AM SSL Decryption Methods

On Classic Segments with Plaintext Modification disabled, the data encrypted in the TLS session between the client and the SSL
Visibility appliance is identical to the data encrypted in the TLS session between the SSL Visibility appliance and the server. When
Plaintext Modification is enabled, or when offloading to a ProxySG device, the data may be altered by the attached appliance. In all
cases, the encrypted traffic is different because the two TLS sessions have different cryptographic session details.
Traffic to many different SSL servers with different SSL server certificates can be inspected by a single SSL Visibility appliance.

Certificate Resigning Method

Certificate resign is used when it is impossible to obtain a copy of the SSL server's private key and certificate, which is normally the
case for any SSL servers not controlled by the organization deploying the SSL Visibility appliance. In general any “outgoing” SSL traffic
from an organization will need to be inspected using certificate resign.

Note
In order to use certificate resign, the SSL Visibility appliance must be a MITM which means the SSL Visibility appliance must be
connected in inline mode.

Note
Passive-Tap mode is not supported in this release.

The client initiates an SSL session to the server and the server responds by sending it's SSL server certificate to the client. As all traffic
between client and server passes through the SSL Visibility appliance it can detect and intercept the server certificate.
Once the SSL Visibility appliance has intercepted the server certificate, it replaces the servers public keys with its own public keys and
modifies the Certificate Revocation List (CRL) details in the server certificate. Having modified the server certificate, the SSL Visibility
then resigns the server certificate using a Certificate Authority (CA) certificate and CA private key that is installed in the SSL Visibility
appliance.
The resigned server certificate is then sent over the network to the client. If the client trusts the CA that was used to sign the server
certificate it receives it will not generate any warnings. As the modified server certificate now contains public keys that are associated
with private keys within the SSL Visibility appliance, it is possible for the SSL Visibility appliance to inspect the traffic.
When certificate resign is used the two SSL sessions will always have different cryptographic session details and the SSL Visibility
appliance will have to re-encrypt the plaintext before sending it back to the network.
[Link] 2/4
10/10/25, 8:51 AM SSL Decryption Methods

As noted, the client must trust the CA used to resign the server certificate; otherwise it will generate warnings indicating that the SSL
session should not be trusted. In order to ensure that the client does trust the CA used by the SSL Visibility appliance, there are two
approaches that can be taken.
1. The SSL Visibility appliance can generate a CA certificate and keys internally and use these to resign server certificates. The CA
certificate which includes the CA public key can be exported from the SSL Visibility appliance, and then imported into the trusted CA
store on the client; you only have to do this once.
2. If the SSL Visibility appliance is deployed in a network that already has a private public key infrastructure (PKI), this can be used to
issue an intermediate CA certificate and keys which can be loaded into the SSL Visibility appliance. As the intermediate CA is issued
by the enterprise root CA it, will automatically be trusted by all clients in the enterprise as will all server certificates that are signed by
the intermediate CA.

Use of EC Resigning CAs

Certificate authorities might sign server certificates with either RSA or Elliptic Curve keys. Best practice is to resign the server certificate
using the same type of key as the original CA. Preserving the resigning key type minimizes chances of interoperability problems.
Hence, it is recommended that SSL Visibility appliance have two internal resigning CAs on the appliance, one that uses RSA keys, and
another using EC keys. You can create or load keys that use either RSA or EC keys for use in resigning server certificates.
In the Inspection Service Decrypt (Resign Certificate) rule configurations for resigning CAs, specify an external resigning CA that uses
RSA keys, and another that uses EC keys. See Inspection Services for more information.

Note
If only one resigning CA is configured, this CA will be used to resign both RSA and EC flows. For example, if no EC Resigning CA
is specified, all EC flows will be resigned with the RSA Resigning CA.

Self-Signed Server Certificate Handling

Some SSL servers have server certificates that are self-signed, meaning the server generated the certificate and keys and then signed
the certificate itself, rather than having the certificate signed by a Certificate Authority (CA). Self-signed certificates are inherently less
trustworthy than certificates signed by a trusted CA, so some organizations might have a policy of not allowing SSL connections to
servers that are using a self-signed certificate. The SSL Visibility appliance can be used to enforce such policies (see Policy Rulesets).
If SSL connections to servers using self-signed certificates are allowed, the SSL Visibility appliance can inspect the traffic two ways.
Resign the certificate the same way a non self-signed certificate is resigned; see "Certificate Resigning Method" on page 18. This
method is used if Decrypt (Resign) mode is chosen.
The second method involves the self-signed certificate information (that is, subject and issuer) not being modified and only the public
key and signature in the X.509 structure being replaced, effectively keeping the certificate self-signed. This method is used if "Replace
Key Only" mode is used. This is the recommended method as it means the client still knows that the certificate is self-signed.
If SSL Visibility appliance policy control has been used to block all traffic to servers using self-signed certificates, it is possible to
explicitly allow traffic to a specific server using a self-signed certificate by loading a copy of the self-signed certificate into the Trusted
Certificates store in the SSL Visibility appliance.

Mark SSL Plaintext

The generated flow containing plaintext obtained from inspected SSL traffic can optionally be marked by the SSL Visibility appliance, by
modifying the source MAC address to allow an attached device to distinguish this traffic from other traffic that was not inspected.

Note
In SSL Visibility 4.x, marking plaintext for active-inline segments is optional; it is no longer mandatory.

Content feedback and comments

Products

Solutions

Support and Services

[Link] 3/4
10/10/25, 8:51 AM SSL Decryption Methods

Company

How To Buy

Copyright © 2005-2025 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.

Privacy Supplier Responsibility Terms of Use Site Map

  

[Link] 4/4