Decryption keys allow AppResponse 11 to develop and display performance metrics for SSL-encrypted data streams. An administrator at an endpoint of the encrypted data connection gives an AppResponse 11 administrator a PEM-formatted private key and, if necessary, a password or passphrase. The AppResponse 11 administrator places the private key into the Administration > General Traffic Settings: SSL Decryption Keys page and, if necessary, enters the password or passphrase. AppResponse 11 uses this to monitor the encrypted data for measuring packet statistics and obtaining information from packet headers.

Packets are decrypted “on the fly” as needed for Insights. You cannot store, dump or export decrypted packets. Decrypted packets or data cannot be exported to Wireshark, NetProfiler or other devices or applications outside the appliance.

AppResponse 11 decrypts RSA key exchange based ciphers only. It does not decrypt Diffie-Hellman key exchange based ciphers.

For AppResponse 11 to use the private key to decrypt data, SSL Decoding must be enabled on the Administration > Web Page Analysis page, in the Data Collection Options tab.

To delete a private key, either hover over the entry in the table and choose the delete (x) icon, or else select the check box at the beginning of the row and choose Delete near the top of the page.

This tab shows the details for each certificate that matches the installed private keys. The details are the same we show in the “missing” tab.

This tab lists streams for which encryption keys are not currently installed. Click Ignore to add a stream to the list of keys that should be ignored. Click Delete to remove a certificate from the database explicitly.

This tab lists streams for which encryption keys are not currently installed, and are disregarded. Click Unignore to move a stream to the Certificates With Missing Keys tab. Click Delete to remove a certificate from the database explicitly.

When communicating with systems using Perfect Forward Secrecy (PFS) for encryption, the AppResponse 11 system will need to buffer packets until it has received and accepted the unique Diffie-Hellman master secret to be used for the session. Select the Enable buffering for PFS decryption option in the PFS tab to activate this buffering.

The following SSL ciphers are supported for decoding: