SSL forward proxy configuration using J-Web can only be done on Junos 15.1X49-D100 and later. The basic functionality of SSL proxy is to setup the SRX to be a proxy between clients and server for HTTPS connections. This enables the SRX to see the details of the encrypted traffic based on which functions can be performed, such as UTM, IDP, AppFW, AppTrack, APBR, and Sky ATP.

The following excerpt from the Release Notes: JunosOS Release 15.1X49-D100 for the SRX Series provides an explanation of the J-Web support for SSL Proxy and User Firewall feature:

J-Web support for SSL Proxy and User Firewall on SRX platforms—Starting with Junos OS Release 15.1X49-D100

J-Web will support SSL Proxy (SSL Forward Proxy Profile, Associate proxy profile to a security policy) and User Firewall (UserFW captive portal HTTPS redirect support, Active Directory profile) on SRX1500, SRX300, SRX320, SRX340, SRX345, SRX320-poe, SRX4100, and SRX4200 platform

a) For the server, SSL proxy acts as a client—Because SSL proxy generates the shared pre-master key, it determines the keys to encrypt and decry​
b) For the client, SSL proxy acts as a server—SSL proxy first authenticates the original server and replaces the public key in the original server certificate with a key that is known to it. It then generates a new certificate by replacing the original issuer of the certificate with its own identity and signs this new certificate with its own public key (provided as a part of the proxy profile configuration). When the client accepts such a certificate, it sends a shared pre-master key encrypted with the public key on the certificate. Because SSL proxy replaced the original key with its own key, it is able to receive the shared pre-master key. Decryption and encryption take place in each direction (client and server), and the keys are different for both encryption and decryption.

SSL Proxy configuration has basic 4 steps:
I. Installing CA certificates
II. Installing Selfsigned/Identity certificate for incoming interface on SRX
III. Activating SSL proxy
IV. Enabling SSL proxy in Security Policy for the desired traffic (Just like UTM or IDP is enabled)

**Note: On SRX300 and SRX320 devices, SSL forward proxy is supported from Junos 18.1R1

Perform the following steps to configure SSL forward proxy using J-Web.  

Tip: For more information and the CLI instructions, refer to Configuring SSL Forward Proxy .

1. Access J-Web on SRX series devices running Junos 15.1X49-D100 and later. Go to Configuration > Security > SSL Proxy and click on Launch Certificate Management :

   

2. Under Certificate Management, in the More pull-down, click on Generate Trusted CAs :

   

   
   Note: This may take approximately 10 minutes to load.

   Once it is done, select the More pull-down, and confirm that the option to View Trusted CAs is enabled:

   

3. Install Identity Certificate for the incoming interface of the SRX for HTTPS connections to the server. In this scenario, a Self Signed certificate is used, but an Identity Certificate signed by a third party can also be used which is for the interface IP or FQDN:

   Click the ' + ' at the top right to add a self signed certificate:

   

   Click Generate > Next. Add various values for the certificate (below), Domain and One Subject field, which is mandatory and the IP of the interface:

   
4. Configure the SSL Proxy Profile. Go to Configuration > Security > SSL Proxy and click the ' + ':
   
   
   
   

   Commit the configuration:

   
    
5. To apply this SSL Proxy Profile to specific traffic, go to Security > Firewall Policy > Rules and select the rule you want apply this profile to. Click on Edit and under Advanced Security, select SSL Proxy Profile:
   
   
    
6. The last and very important step is to go to Administration > Certificate Management and download the self-signed certificate. This certificate needs to be installed on ALL client PCs as their TRUSTED ROOT CA, so an authenticated SSL connection can be formed between the clients and the SRX.

   Example:

   A network admin can push the cert using Group-policy in AD or install it on each PC by going to certmgr.msc > Trusted Root CA >Certificate; right-click and import the certificate.