We have various servers in our DMZ's. Some of them are behind load balancers (but only few). We also have BlueCoat SSL Visibility Appliances currently deployed in passive-tap mode (we get the inbound and outbound traffic copy via SPAN) - in this mode we could only decrypt RSA but not DH traffic.

We are looking for a way to get inline to be able to decrypt all traffic regardless if it is RSA or DH. One option we see is to put the SSL VA's inline and make use of HSM for certificate management. What other options are there? Could you please advise?

  • Do you mean in BlueCoat, or generally?
    – schroeder
    Oct 16, 2018 at 12:11
  • Generally. BlueCoat is one option. But maybe there are better more efficient ways to address our problem? Oct 16, 2018 at 12:34


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.