SSL Inspection

Setting the HTTPS Inspection Level

Before you set the SSL inspection level, make sure you have installed the SSL certificate. See sk179817.

To set the HTTPS Inspection level:

  1. Click Policy > SSL Inspection.

  2. Deploy the Check Point Certificate in your branch office. From the Select Inspection Level list, select one:

    • Basic Inspection

    • Full Inspection

  3. From the Exceptions list, select the exceptions:

  4. In the Activate full inspection field, select where to apply the full HTTPS InspectionClosed Feature on a Security Gateway that inspects traffic encrypted by the Secure Sockets Layer (SSL) protocol for malware or suspicious patterns. Synonym: SSL Inspection. Acronyms: HTTPSI, HTTPSi..

  5. Click Install Policy.

Best Practice - Enable Full HTTPS inspection and create exceptions for privacy-related websites with an option of gradual deployment.

Updatable Objects

An updatable object is a network object which represents an external service. For example:

  • Online services - Office 365, Azure, and AWS

  • GEO locations - The GEO database provides mapping of location data to IP addresses. For each location, there is a network object you can import. You can block or allow access to and from specific locations based on their IP addresses.

External services providers publish lists of IP addresses or Domains or both to allow access to their services. These lists are dynamically updated. Updatable objects derive their contents from these published lists of the providers, which Check Point uploads to the Check Point cloudClosed An administrator approved Harmony Connect cloud location that processes the internet and corporate traffic.. The updatable objects are updated automatically each time the provider changes a list. There is no need to install policy for the updates to take effect.

You can add updatable objects:

Downloading the Full Inspection Certificate

To download the active full inspection certificate:

  1. Click Policy > SSL Inspection.

  2. Under Download Full Inspection Certificate, click Download Certificate.

    The system downloads the certificate.

Managing Certificates

You can generate, upload, set a certificate as active, download and delete certificates.

To manage certificates:

  1. Click Policy > SSL Inspection.

  2. Under Download Full Inspection Certificate, click Manage Certificates.

    The Manage Certificates window appears.

  3. To generate a new Check Point certificate:

    1. Click New.

    2. In the Enter Certificate name field, enter a name for the certificate.

    3. Click Generate certificate.

      The certificate is added to the table.

  4. To upload a certificate:

    1. Click Upload.

      A window appears.

    2. Click Select File and select the file.

    3. In the Private key password field, enter the private key password.

    4. In the Enter Certificate name field, enter a name for the certificate.

    5. Click Add.

      The certificate is added to the table.

  5. To set a certificate as active:

    Warning - Before you set a certificate as active, ensure that you have distributed the certificate to all the user computers.

    1. Select the certificate in the table that is not active.

      Note - You can set only one certificate as active.

    2. Click Set as active

      A warning message appears.

    3. Select the I have distributed this certificate, let's continue checkbox.

    4. Click Set as Active.

      The system take a while to set the certificate as active. When the system sets the certificate as active, it displays the new active certificate under Download Full Inspection Certificate.

  6. To download a certificate:

    1. Click Download.

      The system downloads the certificate.

  7. To delete a certificate:

    Note - You cannot delete an active certificate.

    1. Select the certificate in the table that is not active.

    2. Click Delete.

      The certificate is deleted from the table.