We have various servers in our DMZ's. Some of them are behind load balancers (but only few). We also have BlueCoat SSL Visibility Appliances currently deployed in passive-tap mode (we get the inbound and outbound traffic copy via SPAN) - in this mode we could only decrypt RSA but not DH traffic.
We are looking for a way to get inline to be able to decrypt all traffic regardless if it is RSA or DH. One option we see is to put the SSL VA's inline and make use of HSM for certificate management. What other options are there? Could you please advise?