Trellix appliances use X.509 (TLS/SSL) certificates to allow secure connections between the appliance and the Web browser running the Web UI, and to verify remote servers for various client applications. They also use the certificates to encrypt the emails they forward to a downstream MTA on the Email Security — Server appliance. They also use the certificates to secure the connection to a WebDAV server on the File Protect appliance.
The VX Series appliance
The Intelligent Virtual Execution - Server appliance has a CLI, but does not have a Web UI. A message such as the following is displayed when you attempt to access the Intelligent Virtual Execution - Server appliance using a Web browser. The provided system self-signed certificate secures the Web session that displays this message. Information about replacing this certificate with an HTTPS certificate and adding a Web server chain are included in this guide, although there is little practical reason to do so.
System self-signed server certificate
The appliance automatically generates and maintains a self-signed server certificate with the reserved name system-self-signed. This is the default certificate for the appliance, and can be used for Web UI sessions and MTA email forwarding. The appliance hostname is used in the certificate's Common Name (CN) attribute. If the hostname or other pertinent system identity information changes, the certificate is automatically regenerated to reflect the current information. For details, see Regenerating the system self-signed certificate.
HTTPS and MTA server certificates
Instead of using the system self-signed certificate, you can install an alternate HTTPS or MTA certificate, such as one issued by a trusted public certificate authority (CA) or your own organization. The HTTPS certificate has the reserved name web-cert. The MTA certificate has the reserved name mta-cert. This certificate is not tied to the appliance hostname. For details, see Managing HTTPS certificates.
Web server CA certificate chains
You can add a certificate chain to an Apache Web server. This establishes a chain of trust for a server SSL certificate by providing signing CA certificates to the Web browsers running the Web UI. For example, if the root CA is present on the Web browser, but the intermediate CAs are absent, the CA chain allows the Web browsers to find the intermediate CAs, which would otherwise not be possible. For details, see Configuring a web server CA certificate chain.
Certificate Authority (CA) client certificates
The appliance has an internal bundle of well-known trusted CA certificates distributed by Mozilla. These certificates serve as root CA certificates for HTTP servers that have publicly issued certificates. However, some SSL-enabled applications (such as the system email server and the LDAP server) connect to HTTPS servers that have privately issued certificates. You must add one or more intermediate or trusted private root certificates as supplemental CA certificates to validate against the private certificates on these servers. For details, see Adding supplemental CA certificates.