How ServerHello and server certificate messages work

Summary

The key components involved in ServerHello and server certificate message handling are:

Managed device: Processes ServerHello and server certificate messages and performs rule matching
decryption rules: Define actions to take when messages match specific criteria
Server certificate data: Certificate information used for matching against internal certificate objects
TLS/SSL handshake: The secure connection establishment process
Certificate authority (CA): Used for re-signing certificates in decrypt-resign actions

Workflow

These stages describe how ServerHello and server certificate message handling works:

The managed device receives ServerHello and server certificate messages and checks for rule matches. If the messages do not match any decryption rules, the managed device performs the default actions.
When messages match a rule that belongs to a decryption policy associated with an access control policy, the managed device performs actions based on the rule configuration.
- Monitor: The TLS/SSL handshake continues to completion. The managed device tracks and logs traffic but does not decrypt it.
- Block or Block with Reset: The managed device blocks the TLS/SSL session and, if configured, resets the TCP connection.
- Do Not Decrypt: The TLS/SSL handshake continues to completion. The managed device does not decrypt the application data exchanged during the TLS/SSL session.

For decrypt actions with known key or resign methods, the managed device performs certificate matching and processing.

Decrypt - Known Key: The managed device attempts to match the server certificate data to an Internal Certificate object previously imported into the Security Cloud Control. Because you cannot generate an Internal Certificate object, and you must possess its private key, we assume you own the server on which you're using known key decryption.
Decrypt - Resign: The managed device processes the server certificate message and re-signs the server certificate with the previously imported or generated certificate authority (CA). The TLS/SSL handshake continues to completion. The managed device then uses the uploaded private key to decrypt and re-encrypt the application data exchanged during the TLS/SSL session.

If the certificate matches a known certificate, the TLS/SSL handshake continues to completion. The managed device uses the uploaded private key to decrypt and re-encrypt the application data exchanged during the TLS/SSL session. If the server changes its certificate between the initial connection with the client and subsequent connections, you must import the new server certificate in the Security Cloud Control for future connections to be decrypted.

Note	The Firepower System does not support mutual authentication; that is, you cannot upload a client certificate to the Security Cloud Control and use it for Decrypt - Resign, Decrypt - Replace Cert, or Decrypt - Known Key decryption rule actions.