I have a query regarding the SSL inspection functionality on the USG110 series and above. I have a requirement to provide a public Wi-Fi access point, and I’m looking at using a USG110 to provide application control, and content filtering which I can get working ok with HTTP traffic, the challenge I’m having is with HTTPS traffic and being able to use application control and content filtering with this type of traffic to provide protection for the client I’m working with.
I have been able to use IDP to block traffic based on the signature for traffic for example I have been able to block HTTPS to the Spotify website and then with app control also block access to the Spotify desktop application. What I’m looking to do is not have to create a rule for each website or application we want to block through IDP as with the Spotify example it did not block all elements of Spotify and I had to use a mixture of App Patrol and IDP. This is where I’m looking to use the SSL inspection feature along with App Patrol and Content filtering on the USG110 to give me a complete overview of all traffic being passed through the network and apply polices to this traffic.
The query I have around SSL inspection is regarding the SSL certificate, as it is a public Wi-Fi access point I’m unable to control the devices that will connect to this network and thus cannot install the self-signed certificate on to each device so it will recognise any HTTPS traffic that is scanned by the USG as being from a trusted source. If I was to purchase a third party SSL certificate from a certificate authority and then import this onto the USG would this take away the need for the self-signed certificate on the USG to be used, and allow the HTTPS connection to an external source to show as a trusted connection on the devices?
Thanks in advance for your response