Configure TLS/SSL settings to establish secure encrypted connections with host servers that require certificate-based authentication.
Configure SSL Settings if the host server requires an encrypted connection.
Before you begin
Follow these steps to configure TLS/SSL settings for a Threat Intelligence Director source:
Procedure
Step 1 | In the Edit Source dialog box, expand the SSL Settings section. |
Step 2 | If your server certificate is self-signed:
-
Enable Self-Signed CERTIFICATE.
-
Choose a SSL Hostname Verification method.
-
Strict—Threat
Intelligence Director requires the source URL to match the hostname provided in the server certificate.
If the hostname includes a wildcard, TID cannot match more than one subdomain.
-
Browser Compatible—Threat
Intelligence Director requires the source URL to match the hostname provided in the server certificate.
If the hostname includes a wildcard, TID matches all subdomains.
-
Allow All—Threat
Intelligence Director does not require the source URL to match the hostname provided in the server certificate.
For example, if subdomain1.subdomain2.cisco.com is your source URL and *.cisco.com is the hostname provided in the server certificate:
-
Strict hostname verification fails.
-
Browser Compatible hostname verification succeeds.
-
Allow All hostname verification ignores the hostname values completely.
-
For Server CERTIFICATE:
-
If you have access to the PEM-encoded self-signed server certificate, open the certificate in a text editor and copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines. Enter this entire string into the field.
-
If you do not have access to the self-signed server certificate, leave the field blank. After you save the source, Threat
Intelligence Director retrieves the certificate from the server.
|
Step 3 | If your server requires a user certificate:
-
Enter a User certificate:
Open the PEM-encoded certificate in a text editor and copy the entire block of text, including the BEGIN CERTIFICATE and END CERTIFICATE lines. Enter this entire string into the field.
-
Enter a User PRIVATE KEY:
Open the PRIVATE KEY file in a text editor and copy the entire block of text, including the BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY lines. Enter this entire string into the field.
|