{"id":347,"date":"2019-07-11T16:07:16","date_gmt":"2019-07-11T16:07:16","guid":{"rendered":"https:\/\/cheapsslsecurity.com\/p\/?p=347"},"modified":"2019-09-06T07:45:47","modified_gmt":"2019-09-06T07:45:47","slug":"what-is-ssl-inspection","status":"publish","type":"post","link":"https:\/\/cheapsslsecurity.com\/p\/what-is-ssl-inspection\/","title":{"rendered":"What is SSL Inspection and Why Should You Use It?"},"content":{"rendered":"

Inspecting your HTTPS traffic is critical, especially at scale<\/h2>\n

A lack of SSL inspection can bring down giants. Do you remember the Equifax data breach \u2014 the one that compromised the data of millions of people, cost millions of dollars and caused the credit bureau to get its own credit rating downgraded? Yeah, that one. The breach went unaddressed for 76 days because an expired digital certificate caused it to lose the ability to inspect its own traffic.<\/p>\n

<\/p>\n

Had Equifax had that ability, it would\u2019ve noticed that amount of data being exfiltrated by the attackers and could have mitigated the problem much faster \u2014 and with much less damage. Instead, the attackers were able to hide in Equifax\u2019s HTTPS traffic and operate undetected.<\/p>\n

Now, there are two major lessons to learn from that. The first is that certificate management is critical. Allowing an SSL certificate expiration<\/a> to occur is one thing; not fixing it for 76 days \u2014 which implies you didn\u2019t notice \u2014 is downright negligent. That just can\u2019t happen \u2014 and it doesn\u2019t with the right certificate management solution.<\/p>\n

But that\u2019s not why we\u2019re here. We\u2019re here for the other takeaway: SSL inspection, sometimes called HTTPS inspection, is critical.<\/p>\n

What is SSL Inspection?<\/h2>\n

\"Graphic:SSL inspection<\/a>, in the simplest terms, is decrypting the traffic that\u2019s coming through your site and inspecting it before it actually has a chance to reach the site itself. If that sounds a bit abstract, think of it like a security checkpoint. In most configurations, the encrypted traffic gets all the way to your website before it gets decrypted and, at that point, it\u2019s right at your doorstep. SSL inspection is like putting a security checkpoint at the perimeter, where it can check for any bad actors before<\/em> they have the chance to reach your doorstep.<\/p>\n

The Nitty-Gritty of SSL Inspection<\/h2>\n

That\u2019s the simple explanation. Now let\u2019s look at it from a technical standpoint. Internet connections are incredibly complicated \u2014 it\u2019s not just a 1:1, client-routes-straight-to-the-server type of situation. And for larger websites, a single server isn\u2019t even what powers the site. There may be multiple servers handling multiple functions. For instance, at a certain size, if you\u2019re still using RSA key exchange it\u2019s advisable that you offload all those encryption and decryption functions that occur during the handshake<\/a> to a dedicated device to free up resources on the application server that actually hosts most of its core functions. The server uses up 15 times more resources during an RSA handshake than the client does.<\/p>\n

What Happens with SSL Offloading<\/h3>\n

This is called SSL offloading. And understanding what that is will help you better understand HTTPS inspection. SSL inspection is a form of SSL offloading. With SSL inspection, you offload the SSL functions to an edge device the decrypts all of the traffic that\u2019s incoming and outgoing so that it can be filtered. There are two options from there:<\/p>\n