SSL proxy acts as an intermediary, performing SSL encryption and decryption between the client and the server. Better visibility into application usage can be made available when SSL forward proxy is enabled.

Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet. SSL, also called Transport Layer Security (TLS), ensures the secure transmission of data between a client and a server through a combination of privacy, authentication, confidentiality, and data integrity. SSL relies on certificates and private-public key exchange pairs for this level of security.

SSL proxy is transparent proxy that performs SSL encryption and decryption between the client and the server.

1. Configuring the root CA certificate
a. From operational mode, generate a PKI public/private key pair for a local digital certificate.
> request security pki generate-key-pair certificate-id certificate-id size size type type
b. define a self-signed certificate
> request security pki local-certificate generate-self-signed certificate-id certificate-id domain-name domain-name subject subject email email-id add-ca-constraint

2. Configure SSL proxy profile and associate root CA certificate 
# set services ssl proxy profile profile-name root-ca certificate-id

3. Import the root CA as a trusted CA into client browsers. This is required for the client browsers to trust the certificates signed by the SRX Series Firewall.

4. Create a security policy by defining input traffic match criteria
# set security policies from-zone trust to-zone untrust policy policy-name match source-address source-address
# set security policies from-zone trust to-zone untrust policy policy-name match destination-address destination-address
# set security policies from-zone trust to-zone untrust policy policy-name match application application

5. Applying an SSL proxy profile to a security policy
# set security policies from-zone trust to-zone untrust policy SECURITY_POLICY then permit application-services ssl-proxy profile-name SECURITY-SSL-PROXY

Please note the following limitations for SSL proxy service on SRX firewalls：
- The SSLv3.0 protocol support is deprecated.
- The SSLv2 protocol is not supported. SSL sessions using SSLv2 are dropped.
- Only X.509v3 certificate is supported.
- Client authentication of SSL handshake is not supported.
- SSL sessions where client certificate authentication is mandatory are dropped.
- SSL sessions where renegotiation is requested are dropped.
- On SRX Series Firewalls, for a particular session, the SSL proxy is only enabled if a relevant feature related to SSL traffic is also enabled. Features that are related to SSL traffic are IDP, application identification, application firewall, application tracking, advanced policy-based routing, Content Security, ATP Cloud, and ICAP redirect service. If none of these features are active on a session, the SSL proxy bypasses the session and logs are not generated in this scenario.
- SRX Series Firewalls operating in Multi-node High Availability setup do not support the SSL proxy functionality.

For more details, please refer to:

SSL Proxy
Configuring SSL Proxy

2025/12/18: Minor, non-technical edits
2025/12/05: Added SRX Branch and HE, publish to public
2025/12/: Rephrase the KB and added contents related to applying SSL proxy to security policy and list its limitations

SSL Proxy
Configuring SSL Proxy