When Cisco Firepower Threat Defense (Cisco Secure Firewall) acts as a Man in the Middle to perform SSL Decryption for Outbound Traffic.
After intercepting the HTTPS Request, Firepower will:
- Retrieve the server certificate from the external server.
- Create a new (spoofed) certificate with all the fields and sign this with its own internal CA Certificate.
But Firepower will remove the fields highlighted in red color that break the TLS connection, for example the CRL Distribution Points to prevent the client to go to internet in order to check if the certificate was'nt revoked.
