About HTTPS

What is HTTPS?

HTTPS is a solution for handling nonadministrative SSL traffic. HTTPS uses the SSL protocol securely encrypt HTTP requests and responses.

SSL

SSL is an industry standard protocol for ensuring confidentiality. It is built into all major browsers and Web servers. SSL ensures confidentiality by using key cryptography algorithms in combination with a certificate signed by a Certificate Authority (CA).

Key encryption

Public key encryption is a technique that uses a pair of asymmetric keys to encrypt and decrypt messages. Key pairs consist of a public key and a private key. The public key is distributed, but the private key is kept secret.

Data that is encrypted with the public key can be decrypted only with the private key. Conversely, data encrypted with the private key can be decrypted only with the public key. This asymmetry is the property that makes public key cryptography useful. For example, a client uses a server's public key to encrypt a message before sending it to the server, and the server uses a private key to decrypt the message.

Certificates

Certificates are used for the secure transfer of public keys. CA-signed certificates are signed by a mutually trusted authority for secure Web services, such as Verisign, Inc. Signed certificates provide your browser with a way to verify identity.

For example, a signed message is encrypted with a private key. Devices that receive the message decrypt it with the public key. The public key is used to verify that a message is from a particular party. CA-signed certificates are the most secure method of configuring SSL for devices on the Internet.

Root certificates

A root certificate is a self-signed certificate from a CA. Root certificates are explicitly trusted and are used to authenticate other certificates. The appliance is installed with standard certificates for many CAs.

Key and certificate management

Private key files and certificates are stored in PEM (Privacy Enhanced Mail) format on the appliance's internal file system after being encrypted with a password. The password used to encrypt the private key is machine-generated on each appliance and hidden on disk to ensure that only a Data ONTAP^TM process can access it. The appliance administrator will not have access to the password that is used to encrypt the private keys.

Downloading key files and certificates

HTTPS options on the Authentication - SSL Contexts page enable you to download private key, user certificate, and root certificate files from an HTTP URL to the cache. On each download page, you have the option to enter a password. This password enables the appliance to decrypt the private key that is downloaded. It must be same password that was used to encrypt the key on the host device. Once downloaded, private keys are encrypted and hidden on disk.

Note
To ensure a secure transfer, Network Appliance recommends that you place the appliance and the host device that contains the keys on a private network. Files can then be securely transferred before the appliance is returned to a public domain.

Supported encryption methods

The appliance supports the following types of encryption:

Public key encryption
RSA algorithm with modulus sizes of 512, 768, 1,024, and 2,048 bits
Data encryption
DES algorithm with 40- and 56-bit keys, using CBC (Cipher Block Chaining) mode

3DES algorithm with 168-bit keys, using CBC and EDE (Encrypt-Decrypt-Encrypt) mode

RC4 algorithm with 40-, 56-, and 128-bit keys

RC2 algorithm with 40-bit keys, using CBC mode