Describes the SSL proxy feature in AppQoE, which optimizes SSL traffic by decrypting, processing, and re-encrypting it, and outlines TLS protocol usage, default TLS 1.3 support, and fallback to TLS 1.2.
A Secure Sockets Layer (SSL) proxy is a security feature that
-
acts as an intermediary between the client and the server to optimize SSL traffic securely and transparently
-
decrypts encrypted traffic, optimizes it, and then re-encrypts it
-
uses Transport Layer Security (TLS) to secure and encrypt communication while allowing optimization of SSL traffic
TLS protocol support
The SSL proxy uses Transport Layer Security (TLS) as a protocol to secure and encrypt communication between the client and the server, and optimize the SSL traffic. Starting from Cisco IOS XE Catalyst SD-WAN Release 17.13.1a and Cisco Catalyst SD-WAN Manager Release 20.13.1, SSL proxy supports TLS version 1.3. TLS version 1.3 is more widely deployed and is simpler, faster, and more secure than version 1.2.
In SSL proxy, the support for a TLS 1.3 version is enabled by default. When a TLS 1.3 version is not available, the SSL proxy switches to using the TLS 1.2 version.
For more information, see Overview of SSL/TLS Proxy.
For information about verifying the TLS version, see Verify SSL proxy support for TLS 1.3 with CLI