Configure the Key Size for SSL Forward Proxy Server Certificates

Select
Device
Setup
Session
and, in the Decryption Settings section, click
SSL Forward Proxy Settings
.
Edit the Forward Proxy Server Certificate Settings.
Select an
RSA Key Size
:
Defined by destination host
(
default
)—The firewall determines the key size and the hashing algorithm for the certificates it generates to establish SSL proxy sessions with clients based on the destination server certificate.
If the destination server uses a 1,024-bit RSA key, the firewall generates a certificate with a 1,024-bit RSA key.
If the destination server uses a key size larger than 1,024 bits (for example, 2,048 or 4,096 bits), the firewall generates a certificate with a 2,048-bit RSA key.
If the destination server uses the SHA-1 hashing algorithm, the firewall generates a certificate with the SHA-1 hashing algorithm.
If the destination server uses a hashing algorithm stronger than SHA-1, the firewall generates a certificate with the SHA-256 algorithm.
1024-bit RSA
—The firewall generates certificates that use a 1,024-bit RSA key and the SHA-256 hashing algorithm regardless of the key size of the destination server certificates.
As of December 31, 2013, public certificate authorities (CAs) and popular browsers have limited support for X.509 certificates that use keys of fewer than 2,048 bits. In the future, depending on security settings, when presented with such keys the browser might warn the user or block the SSL/TLS session entirely.
2048-bit RSA
—The firewall generates certificates that use a 2,048-bit RSA key and the SHA-256 hashing algorithm regardless of the key size of the destination server certificates. Public CAs and popular browsers support 2,048-bit keys, which provide better security than 1,024-bit keys.
3072-bit RSA
—The firewall generates certificates that use a 3,072-bit RSA key and the SHA-256 hashing algorithm regardless of the key size of the destination server certificates.
4096-bit RSA
—The firewall generates certificates that use a 4,096-bit RSA key and the SHA-256 hashing algorithm regardless of the key size of the destination server certificates.
Select an
ECDSA Key Size
:
Defined by destination host
(
default
)—The firewall generates certificates based on the key size that the destination server uses.
If the destination server uses an ECDSA 256-bit or 384-bit key, the firewall generates a certificate with that key size.
If the destination server uses a key size larger than 384 bits, the firewall generates a certificate with a 521-bit key.
256-bit ECDSA
—The firewall generates certificates with an ECDSA 256-bit key regardless of the key size that the destination server uses.
384-bit ECDSA
—The firewall generates certificates with an ECDSA 384-bit key regardless of the key size that the destination server uses.
Click
OK
and
Commit
your changes.