Configuring Cloud Probe SSL keys and settings for traffic decryption
This section describes the management of secure socket layer (SSL) keys and the settings for decryption of HTTPS traffic by the Real User Cloud Probe. A web application uses encryption to protect sensitive data that travels between the client and the server. Without the proper deciphering mechanism, the system cannot decrypt the intercepted traffic. To process encrypted traffic, you must upload the appropriate cryptographic keys (SSL keys) to the Cloud Probe host system.
The Cloud Probe supports SSL keys with certificates that use the privacy-enhanced mail (PEM) format.
Note
Passphrase- and Password-protected private keys are not supported.
To configure SSL keys to decrypt Cloud Probe traffic
- Log in to the system where you installed the Cloud Probe with an Administrator account.
- Stop the Cloud Probe service.
Navigate to the Cloud Probe configuration file.
Operating System File location Linux <installDirectory>/cloudprobe/conf
Windows <installDirectory>\cloudprobe\conf
- Copy your private PEM key to the Cloud Probe host system.
- Create a private key with
pem__PEM
suffix:- On Linux, run the following command:
mv /<keyLocation>/<keyName>.pem /<keyDestination>/<keyName>.pem__PEM
- On Windows, rename the file by changing its suffix to
<
keyname>.pem__PEM
.
- On Linux, run the following command:
To manage SSL keys, insert the following code blocks to the epssl.cfg file as shown below or in the Example SSL keys.
keymaterial <privateKeyFilePath>/<keyName>.pem__PEM ON keyfor 0.0.0.0-255.255.0.0 443-443 1 <keyName>.pem
The first line specifies the location of the private key and uses the following syntax:
Keyword
Path to private key
State of key
keymaterial
<privateKeyFilePath>/<keyName>.pem__PEM
ON
<privateKeyFilePath>
is the path to the private key file.- State of the key must be set to
ON
.
The
<privateKeyFilePath>
where you store the keys, should not contain spaces; otherwise, the command will return an error. The SSL key path name must use forward slashes (/), even when the Cloud Probe is on a Windows system.
The second line specifies the properties of the private key mentioned in the previous line, and uses the following syntax:Keyword
IP address (range)
Port (range)
Host ID
Private key
keyfor
0.0.0.0-255.255.0.0
443-443
1
<keyName>
.pem
The private key specified in the second line does not havepem__PEM
suffix.Start the Cloud Probe service.
To verify an SSL key has been loaded properly by a Cloud Probe, the check for the following success message in the installationDirectory/cloudprobe\staging\var\log\epx\epx.log file.
<date and time stamp> info [CORE] INFO: SSL Keys and/or Hosts accept: GOOD
If you receive an error, see SSL CFG ERROR issued for incorrect Cloud Probe SSL key configuration. See also Troubleshooting traffic capture on a Cloud Probe.
Comments
In step 6 what is Host ID?
Hi Matt,
The host ID param is ignored, you can set it to 1 for all your keys.
Alex.
Log in or register to comment.