Cross-signing the CA Certificate for TMWS Cloud Proxy

Views:

By default, TMWS acts as a private Certificate Authority (CA) and uses a default root CA certificate that is sent to client browsers to complete a secure session for HTTPS connection. However, because the default CA certificate is not signed by a trusted CA on the Internet, the client browsers will display a certificate warning each time users access an HTTPS website. Although users can safely ignore the certificate warning, Trend Micro recommends using a cross-signed CA certificate if you have your own certificate.

TMWS allows administrators to cross-sign your organization's own CA certificate with the Certificate Signing Request (CSR) file provided by Trend Micro, and upload the cross-signed certificate on the TMWS management console. Cross-signing the CA certificate establishes a trusted relationship between the TMWS CA certificate and your organization's own CA certificate.

This section describes how to cross-sign your CA certificate with the CSR file for use by the cloud proxy.

Check the following:
- Your organization's CA certificate and the corresponding CA private key and its passphrase are already available.
- The Path Length Constraint in your organization's CA certificate is set to None, so that there is no restriction on the CA certificates down in the hierarchy.
- The administrator has a basic knowledge of openssl commands.
Create a folder named CrossSignTMWSCA_cloud.
Note:
The names of the folders and files created in this section are user customizable.
Go to the newly created folder.
Create a subfolder named newcerts.
Create an empty file named certindex.
Create a file, copy and paste the following text, and then save it as serialfile:
```
000a
```

Create a file, copy and paste the following text into the file, and then save it as tmws_ca.csr:

Create a file, copy and paste the following text into the file, and then save it as a configuration file named myca.conf:

[ca]
default_ca = rootca

[crl_ext]
#issuerAltName=issuer:copy  #this would copy the issuer name to altname
authorityKeyIdentifier=keyid:always

[rootca]
new_certs_dir = newcerts
unique_subject = no
certificate = root.cer  #Your organization's CA certificate
database = certindex
private_key = root.key  #Your organization's CA private key
serial = serialfile
default_days = 3660     #Should be at least two years from the date of cross-signing
default_md = sha256     #sha256 is required.
policy = myca_policy
x509_extensions = myca_extensions

[ myca_policy ]
countryName = supplied
stateOrProvinceName = supplied
localityName = supplied
organizationName = supplied
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

[ myca_extensions ]     #These extensions are required.
basicConstraints = CA:true
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always
keyUsage = keyCertSign, cRLSign

Run the following command to cross-sign your organization's CA certificate using the CSR file: openssl ca -batch -config myca.conf -notext -days 7320 -in tmws_ca.csr -out tmws_ca.cer
A cross-signed certificate named 0A.pem is generated under folder newcerts.
Go to HTTPS INSPECTION > Decryption Rules and upload the certificate in the Cross-signed certificate for cloud part of the Certificate section of a decryption rule as necessary.