Skip to main content

Netskope Help

Configure Certificates

Server side certificates are required to enable SSL inspection. You can use either a self-signed CA certificate or a CA certificate preferably signed by the enterprise's Root or intermediate CA. See Use your own CA Certificates.

Alternatively, the appliance can generate a self-signed certificate without CA. See Generate a Self-signed Certificate without CA.

Use your own CA Certificates

Make sure that the CA certificate of the appliance has a common name.

  1. Enter the command:

    set dataplane forward-proxy server-cert

    Copy and paste your CA certificate in the buffer, press Enter , then type Ctrl-D to exit.

  2. Enter the command:

    set dataplane forward-proxy server-key

    Copy and paste your private key in the buffer, press Enter , then type Ctrl-D to exit.

  3. Enter the command:

    set dataplane forward-proxy server-intermediate-ca-chain

    Copy and paste any additional certificates in the following order:

    1. Server certificate (as provided in step 1)

    2. Intermediate CA certificate 

    3. Root CA certificate

     Press Enter , then type Ctrl-D to exit.

  4. Enter save and press Enter to save the configuration.

Generate a Self-signed Certificate without CA

  1. If you are not using a CA and want the appliance to generate a self-signed certificate, run the following command:

    run request certificate generate forward-proxy self-signed city <city> common-name <common-name> country <country> days <days> email-address <email-address>  organization <organization> organization-unit <organization-unit> state <state>

    Here's an example command to generate self-signed certificate:

    run request certificate generate forward-proxy self-signed city "Los Altos" common-name "dpappliance.netskope.com" organization "netskope" organization-unit "netskope cert authority" state "CA" country "US" email-address "admin@netskope.com"

  2. Enter save and press Enter to save the configuration.

Verifying the Certificates

To verify that the cloud app traffic is forwarded by the Secure Forwarder to the tenant instance in the Netskope cloud, browse to any cloud app domain managed by Netskope and verify that the SSL certificate presented is the certificate installed on the device.

In this section: