11-2
User
Guide

for

the

Cisco

Application

Networking

Manager

5.2
OL-26572-01
Chapter
11






Configuring

SSL
SSL
Overview
SSL
Overview
SSL
i

s

an

application-level

pr

otocol

that

provides

encryption

technology

for

the

Internet,

ensuring
secure
transactions

such

as

the

transmission

of

credit

card

numbers

for

e-commerce

websites.

SSL
initiation
occurs

when

the

ACE

device

(either

an

ACE

module

or

an

ACE

appliance)

acts

as

a

client

and
initiates
the

SSL

session

between

it

and

the

SSL

server.

SSL

termination

occurs

when

the

ACE,

acting
as
an

SSL

server,

terminates

an

SSL

connection

from

a

client

and

then

establishes

a

TCP

connection

to
an
HTTP

server.
SSL
provides

the

secure

transaction

of

data

between

a

client

and

a

server

through

a

combination

of
privacy,
authentication,

and

data

integrity.

SSL

relies

upon

certificates

and

private-public

key

exchange
pairs
for

this

level

of

security.
Figure
11-1

shows

the

following

network

connections

in

which

the

ACE

terminates

the

SSL

connection
with
the

client:

•
Client
t

o

ACE—SSL

co

nnection

between

a

client

an

d

th

e

ACE

acting

as

an


SSL

proxy

server

•
ACE
to
Server—TCP
connection

between

the

ACE

and

the

HTTP

server
Figure
11-1
SSL
Termination

with

Client
The
ACE

uses

parameter

maps,

SSL

proxy

services,

and

class

maps

to

build

the

policy

maps

that
determine
the

flow

of

information

between

the

client,

the

ACE,

and

the

server.

SSL

termination

is

a
Layer
3

and

Layer

4

application

because

it

is

based

on

the

destination

IP

addresses

of

the

inbound

traffic
flow
from

the

cl

ient.

For

t

his

type

of

a

pplication,

you

cr

eate

a

Layer

3

and

Layer

4

policy

map

that

t

he
ACE
applies

to


the

in

bound

t

raffic.


If
you

need

to

delete

any

of

the

SSL

objects

(authorization

groups,

chain

groups,

parameter

maps,

keys,
CRLs,
or

certificates),

you

must

remove

the

dependency

from

within

the

proxy

service

first

before
removing
the

SSL

ob

ject.
Before
configuring

t

he

ACE

for


SSL,

see

the

“SSL

Configuration

Prerequisites”

section

on

pa

ge

11-2 .
SSL
Configuration

Prerequisites
This
SSL

configuration

prerequisites

are

as

follows:

•
Your
ACE

hardware

is

configured

for

server

load

balancing

(SLB).
Note
During
the

real

ser

ver

and
server
farm

configuration

process,

when

you

a

ssociate
a
real
server
with
a

server

farm,

ensure

that

you

assign

an

appropriate

port

number

for

the

real

server.

The
default
behavior

by

the

ACE

is

to

automatically

assign

the

same

destination

port

that

was

used
by
the

i

nbound

connection

t

o

the

out

bound

server

connection

if

you

do

not


specify

a

port.
Client
Front-end
Back-end
Cipher
text
Clear
Text
SSL
Ter

mination
(ACE
as

Ser

ver)
SSL
Ter

mination

with

a

Client
Ser
ver