We have various servers in our DMZ's. Some of them are behind load balancers (but only few). We also have BlueCoat SSL Visibility Appliances currently deployed in passive-tap mode (we get the inbound and outbound traffic copy via SPAN) - in this mode we could only decrypt RSA but not DH traffic.

We are looking for a way to get inline to be able to decrypt all traffic regardless if it is RSA or DH. One option we see is to put the SSL VA's inline and make use of HSM for certificate management. What other options are there? Could you please advise?

  • Do you mean in BlueCoat, or generally? – schroeder Oct 16 '18 at 12:11
  • Generally. BlueCoat is one option. But maybe there are better more efficient ways to address our problem? – blabla_trace Oct 16 '18 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.