{"id":1384,"date":"2025-07-15T09:42:42","date_gmt":"2025-07-15T09:42:42","guid":{"rendered":"https:\/\/virtualall.sk\/?p=1384"},"modified":"2026-09-11T14:45:09","modified_gmt":"2026-09-11T14:45:09","slug":"vyznam-a-fungovanie-https-inspection-v-korporatnom-prostredi","status":"publish","type":"post","link":"https:\/\/virtualall.sk\/en\/2025\/07\/vyznam-a-fungovanie-https-inspection-v-korporatnom-prostredi\/","title":{"rendered":"HTTPS Inspection in Corporate Environment"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>HTTPS Inspection<\/strong> je bezpe\u010dnostn\u00e1 technol\u00f3gia, ktor\u00e1 umo\u017e\u0148uje analyzova\u0165 obsah \u0161ifrovanej HTTPS komunik\u00e1cie. Vzh\u013eadom na to, \u017ee v\u00e4\u010d\u0161ina modern\u00e9ho internetov\u00e9ho prenosu je dnes \u0161ifrovan\u00e1, tradi\u010dn\u00e9 bezpe\u010dnostn\u00e9 syst\u00e9my bez tejto funkcie str\u00e1caj\u00fa schopnos\u0165 efekt\u00edvne odha\u013eova\u0165 \u0161kodliv\u00e9 aktivity, ktor\u00e9 s\u00fa ukryt\u00e9 v \u0161ifrovan\u00fdch d\u00e1tach.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cie\u013eom HTTPS Inspection je <strong>zachova\u0165 vidite\u013enos\u0165 a kontrolu nad t\u00fdm, \u010do prech\u00e1dza cez zabezpe\u010den\u00fd (TLS) kan\u00e1l<\/strong>, pri\u010dom sa odha\u013euj\u00fa hrozby, ktor\u00e9 by inak ostali nepov\u0161imnut\u00e9.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Pre\u010do je potrebn\u00e1 v korpor\u00e1tnom prostred\u00ed?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">V podnikov\u00fdch sie\u0165ach sa \u010doraz \u010dastej\u0161ie objavuj\u00fa hrozby, ktor\u00e9 vyu\u017e\u00edvaj\u00fa \u0161ifrovanie ako prostriedok na skrytie svojho spr\u00e1vania. Medzi naj\u010dastej\u0161ie pr\u00edpady patr\u00ed:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Malv\u00e9r distribuovan\u00fd cez HTTPS<\/strong>, ktor\u00fd nie je zachyten\u00fd be\u017en\u00fdmi antiv\u00edrusmi.<\/li>\n\n\n\n<li><strong>C&amp;C komunik\u00e1cia<\/strong> (Command &amp; Control) medzi kompromitovan\u00fdmi zariadeniami a riadiacimi servermi \u00fato\u010dn\u00edkov.<\/li>\n\n\n\n<li><strong>Phishingov\u00e9 weby s platn\u00fdm TLS certifik\u00e1tom<\/strong>, ktor\u00e9 obch\u00e1dzaj\u00fa z\u00e1kladn\u00e9 kontroly reput\u00e1cie.<\/li>\n\n\n\n<li><strong>Obch\u00e1dzanie bezpe\u010dnostn\u00fdch polit\u00edk<\/strong> pomocou proxy serverov a VPN slu\u017eieb funguj\u00facich cez HTTPS.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Bez in\u0161pekcie \u0161ifrovan\u00e9ho prenosu organiz\u00e1cia <strong>str\u00e1ca preh\u013ead o v\u00e4\u010d\u0161ine svojej sie\u0165ovej prev\u00e1dzky<\/strong>, \u010d\u00edm vznik\u00e1 v\u00e1\u017ene bezpe\u010dnostn\u00e9 riziko.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Ako funguje HTTPS Inspection?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS Inspection pracuje na princ\u00edpe tzv. <strong>man-in-the-middle (MITM)<\/strong> mechanizmu, kde sa bezpe\u010dnostn\u00e9 zariadenie nach\u00e1dza medzi klientom a cie\u013eov\u00fdm serverom:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/ChatGPT-Image-15.-7.-2025-11_41_25.png\" alt=\"Ako funguje HTTPS Inspection?\" class=\"wp-image-1397\" srcset=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/ChatGPT-Image-15.-7.-2025-11_41_25.png 1536w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/ChatGPT-Image-15.-7.-2025-11_41_25-300x200.png 300w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/ChatGPT-Image-15.-7.-2025-11_41_25-1024x683.png 1024w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/ChatGPT-Image-15.-7.-2025-11_41_25-768x512.png 768w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/ChatGPT-Image-15.-7.-2025-11_41_25-18x12.png 18w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><\/figure>\n<\/div>\n\n\n<ol class=\"wp-block-list\">\n<li>Klient sa pok\u00fasi nadviaza\u0165 \u0161ifrovan\u00e9 spojenie s cie\u013eov\u00fdm serverom.<\/li>\n\n\n\n<li>Bezpe\u010dnostn\u00e1 br\u00e1na toto spojenie zachyt\u00ed a vytvor\u00ed si vlastn\u00e9 TLS spojenie so serverom.<\/li>\n\n\n\n<li>N\u00e1sledne vytvor\u00ed samostatn\u00e9 TLS spojenie so samotn\u00fdm klientom, pri\u010dom vyd\u00e1 vlastn\u00fd, dynamicky generovan\u00fd certifik\u00e1t (za predpokladu, \u017ee klient d\u00f4veruje internej certifika\u010dnej autorite).<\/li>\n\n\n\n<li>Prenos je v zariaden\u00ed de\u0161ifrovan\u00fd, analyzovan\u00fd a pod\u013ea definovan\u00fdch polit\u00edk bu\u010f povolen\u00fd, alebo zablokovan\u00fd.<\/li>\n\n\n\n<li>Po schv\u00e1len\u00ed je komunik\u00e1cia za\u0161ifrovan\u00e1 sp\u00e4\u0165 a odoslan\u00e1 cie\u013eov\u00e9mu serveru.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Pr\u00ednosy a mo\u017enosti detekcie<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Zv\u00fd\u0161en\u00e1 vidite\u013enos\u0165 nad sie\u0165ovou prev\u00e1dzkou<\/strong><br>Umo\u017e\u0148uje bezpe\u010dnostn\u00fdm t\u00edmom presne identifikova\u0165, ak\u00fd obsah sa v HTTPS komunik\u00e1cii pren\u00e1\u0161a.<\/li>\n\n\n\n<li><strong>Detekcia \u0161kodliv\u00e9ho k\u00f3du a anom\u00e1li\u00ed<\/strong><br>\u0160ifrovan\u00fd malware, ne\u017eiaduce skripty alebo d\u00e1tov\u00e9 exfiltrovacie pokusy m\u00f4\u017eu by\u0165 v\u010das odhalen\u00e9.<\/li>\n\n\n\n<li><strong>Zabezpe\u010denie s\u00faladu s predpismi<\/strong><br>Pom\u00e1ha pri plnen\u00ed po\u017eiadaviek GDPR, NIS2, ISO 27001 a in\u00fdch \u0161tandardov kybernetickej bezpe\u010dnosti.<\/li>\n\n\n\n<li><strong>DLP (Data Loss Prevention)<\/strong><br>Zabra\u0148uje neautorizovan\u00e9mu prenosu citliv\u00fdch d\u00e1t cez HTTPS kan\u00e1ly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">K\u013e\u00fa\u010dov\u00e9 aspekty nasadenia<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Distrib\u00facia internej certifika\u010dnej autority (CA)<\/strong> na v\u0161etky zariadenia v sieti \u2013 klienti musia d\u00f4verova\u0165 falo\u0161n\u00fdm certifik\u00e1tom generovan\u00fdm bezpe\u010dnostnou br\u00e1nou.<\/li>\n\n\n\n<li><strong>V\u00fdkonov\u00e9 n\u00e1roky<\/strong> \u2013 in\u0161pekcia TLS spojen\u00ed si vy\u017eaduje zna\u010dn\u00e9 v\u00fdpo\u010dtov\u00e9 kapacity, predov\u0161etk\u00fdm pri v\u00e4\u010d\u0161om po\u010dte s\u00fabe\u017en\u00fdch rel\u00e1ci\u00ed.<\/li>\n\n\n\n<li><strong>Vyn\u00edmky<\/strong> \u2013 ur\u010dit\u00e9 typy komunik\u00e1cie, ako internetov\u00e9 bankovn\u00edctvo alebo zdravotn\u00edcke aplik\u00e1cie, by mali by\u0165 z in\u0161pekcie vyl\u00fa\u010den\u00e9 z d\u00f4vodu z\u00e1konn\u00fdch obmedzen\u00ed.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS Inspection je dnes k\u013e\u00fa\u010dovou s\u00fa\u010das\u0165ou modern\u00fdch bezpe\u010dnostn\u00fdch strat\u00e9gi\u00ed vo firemnom prostred\u00ed. V kombin\u00e1cii s \u010fal\u0161\u00edmi opatreniami \u2013 ako s\u00fa firewall, sandboxing, reputa\u010dn\u00e9 datab\u00e1zy a behavior\u00e1lna anal\u00fdza \u2013 poskytuje <strong>komplexn\u00fa ochranu pred sofistikovan\u00fdmi kybernetick\u00fdmi hrozbami ukryt\u00fdmi v \u0161ifrovanej komunik\u00e1cii<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Praktick\u00e9 nasadenie: HTTPS Inspection v prostred\u00ed Check Point<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Medzi naj\u010dastej\u0161ie vyu\u017e\u00edvan\u00e9 rie\u0161enia v enterprise segmente patr\u00ed <strong>Check Point<\/strong> \u2013 zn\u00e1my svojou robustnos\u0165ou, granul\u00e1rnym riaden\u00edm polit\u00edk a vysokou \u00farov\u0148ou integr\u00e1cie so zvy\u0161kom bezpe\u010dnostn\u00e9ho ekosyst\u00e9mu.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">V nasleduj\u00facej \u010dasti \u010dl\u00e1nku sa budeme venova\u0165 praktick\u00e9mu nasadeniu HTTPS Inspection v prostred\u00ed <strong>Check Point Security Gateway<\/strong>, kde si uk\u00e1\u017eeme:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ako spr\u00e1vne nakonfigurova\u0165 in\u0161pekciu TLS komunik\u00e1cie,<\/li>\n\n\n\n<li>ako distribuova\u0165 intern\u00fd certifik\u00e1t do firemn\u00fdch zariaden\u00ed,<\/li>\n\n\n\n<li>a ako nastavi\u0165 v\u00fdnimky, ktor\u00e9 zaru\u010dia s\u00falad so z\u00e1konn\u00fdmi po\u017eiadavkami a funk\u010dnos\u0165 kritick\u00fdch aplik\u00e1ci\u00ed.<\/li>\n<\/ul>\n\n\n\n<h1 class=\"wp-block-heading\">Krok 1: Zapnutie URL Filtering v Check Point SmartConsole<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Na obr\u00e1zku vid\u00edme konfigura\u010dn\u00e9 okno pre <strong>Virtual System Cluster Properties<\/strong> (konkr\u00e9tne firewall <code>fw_cloud<\/code>), kde sa aktivuj\u00fa jednotliv\u00e9 bezpe\u010dnostn\u00e9 moduly (tzv. blades).<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Popis postupu:<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Otvor si <strong>SmartConsole<\/strong> a pre dan\u00fd virtu\u00e1lny syst\u00e9m (napr. VSX) klikni prav\u00fdm tla\u010didlom a zvo\u013e <strong>Edit<\/strong>.<\/li>\n\n\n\n<li>V \u013eavom menu klikni na sekciu <strong>&#8220;Network Security&#8221;<\/strong>.<\/li>\n\n\n\n<li>V \u010dasti <strong>Access Control<\/strong> za\u0161krtni mo\u017enos\u0165 <strong>&#8220;URL Filtering&#8221;<\/strong>.<\/li>\n<\/ol>\n\n\n\n<h4 class=\"wp-block-heading\">\u010co to sp\u00f4sob\u00ed:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Aktiv\u00e1ciou <strong>URL Filtering blade<\/strong> umo\u017en\u00ed\u0161, aby firewall:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>analyzoval nav\u0161tevovan\u00e9 webov\u00e9 adresy (URL),<\/li>\n\n\n\n<li><strong>porovn\u00e1val ich s Check Point reputa\u010dnou datab\u00e1zou<\/strong> (Security Intelligence),<\/li>\n\n\n\n<li>umo\u017enil <strong>vytv\u00e1ra\u0165 politiky pr\u00edstupu<\/strong> na z\u00e1klade kateg\u00f3ri\u00ed (napr. &#8220;Social Networks&#8221;, &#8220;Gambling&#8221;, &#8220;Malware Sites&#8221; at\u010f.),<\/li>\n\n\n\n<li>poskytoval <strong>reporty o webovej aktivite<\/strong> pou\u017e\u00edvate\u013eov.<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"704\" src=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-20.png\" alt=\"\u010co to sp\u00f4sob\u00ed:\" class=\"wp-image-1385\" srcset=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-20.png 768w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-20-300x275.png 300w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-20-13x12.png 13w\" sizes=\"auto, (max-width: 768px) 100vw, 768px\" \/><\/figure>\n<\/div>\n\n\n<h4 class=\"wp-block-heading\">S\u00favis s HTTPS Inspection:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">URL Filtering spolu s <strong>HTTPS Inspection<\/strong> dok\u00e1\u017ee analyzova\u0165 <strong>cel\u00e9 URL aj v \u0161ifrovanej komunik\u00e1cii<\/strong>, nielen dom\u00e9nu. To je mo\u017en\u00e9 len vtedy, ke\u010f je HTTPS komunik\u00e1cia de\u0161ifrovan\u00e1 (man-in-the-middle), tak\u017ee firewall vid\u00ed cel\u00fa po\u017eiadavku \u2013 nielen <code>example.com<\/code>, ale aj <code>\/login<\/code> \u010di <code>\/malware.exe<\/code>.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Krok 2: Zapnutie HTTPS Inspection v Check Point Gateway<\/h1>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"764\" height=\"707\" src=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-21.png\" alt=\"S\u00favis s HTTPS Inspection:\" class=\"wp-image-1386\" srcset=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-21.png 764w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-21-300x278.png 300w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-21-13x12.png 13w\" sizes=\"auto, (max-width: 764px) 100vw, 764px\" \/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Toto nastavenie umo\u017e\u0148uje <strong>aktiv\u00e1ciu in\u0161pekcie \u0161ifrovanej HTTPS komunik\u00e1cie<\/strong> pre Outbound (odch\u00e1dzaj\u00face) spojenia. Cie\u013eom je, aby firewall mohol de\u0161ifrova\u0165, analyzova\u0165 a kontrolova\u0165 obsah HTTPS prenosu.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Step 1: V\u00fdber certifika\u010dnej autority (Outbound CA certificate)<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">V tejto \u010dasti sa definuje, <strong>ktor\u00fd CA certifik\u00e1t bude br\u00e1na pou\u017e\u00edva\u0165<\/strong> na vyd\u00e1vanie dynamick\u00fdch (falo\u0161n\u00fdch) certifik\u00e1tov pre klientov:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>Use the global setting<\/code>: Pou\u017eije sa centr\u00e1lne definovan\u00fd certifik\u00e1t (v administr\u00e1cii SmartDashboard alebo SmartConsole).<\/li>\n\n\n\n<li><code>Override global setting<\/code>: Umo\u017e\u0148uje v\u00fdber vlastn\u00e9ho CA certifik\u00e1tu \u0161pecificky pre tento virtu\u00e1lny syst\u00e9m (VSX), ak m\u00e1 by\u0165 nez\u00e1visl\u00fd od glob\u00e1lnych nastaven\u00ed.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\ud83d\udd38 <strong>CA certifik\u00e1t mus\u00ed by\u0165 d\u00f4veryhodn\u00fd pre v\u0161etky klientsk\u00e9 zariadenia<\/strong> \u2013 inak bud\u00fa pou\u017e\u00edvate\u013eom zobrazovan\u00e9 chyby SSL (napr. v prehliada\u010di).<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Step 2: Nasadenie certifik\u00e1tu do klientsk\u00fdch zariaden\u00ed<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Po v\u00fdbere CA certifik\u00e1tu v <strong>kroku 1<\/strong> je nevyhnutn\u00e9 zabezpe\u010di\u0165, aby <strong>v\u0161etky klientsk\u00e9 zariadenia d\u00f4verovali tejto certifika\u010dnej autorite<\/strong>. Bez tohto kroku nebude m\u00f4c\u0165 Check Point bezpe\u010dnostn\u00e1 br\u00e1na d\u00f4veryhodne generova\u0165 certifik\u00e1ty pre de\u0161ifrovanie TLS spojen\u00ed, \u010do sp\u00f4sob\u00ed chyby v prehliada\u010doch a aplik\u00e1ci\u00e1ch (napr. \u201eYour connection is not private\u201c, <code>NET::ERR_CERT_AUTHORITY_INVALID<\/code>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tento krok <strong>upozor\u0148uje<\/strong>, \u017ee CA certifik\u00e1t pou\u017eit\u00fd v kroku 1 je potrebn\u00e9:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>exportova\u0165 kliknut\u00edm na <strong>Export certificate&#8230;<\/strong>,<\/li>\n\n\n\n<li>a <strong>importova\u0165 do d\u00f4veryhodn\u00fdch certifik\u00e1tov<\/strong> vo v\u0161etk\u00fdch koncov\u00fdch zariadeniach (napr. cez GPO v dom\u00e9ne).<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Bez toho sa HTTPS Inspection <strong>technicky zapne, ale funk\u010dne zlyh\u00e1<\/strong>, preto\u017ee klienti odmietnu falo\u0161n\u00e9 certifik\u00e1ty vydan\u00e9 gatewayom.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Manu\u00e1lne nasadenie na Windows zariadenie (jednorazov\u00e9 testovanie)<\/strong><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Tento postup je vhodn\u00fd na testovanie alebo v men\u0161\u00edch prostrediach bez dom\u00e9ny.<\/p>\n<\/blockquote>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Dvakr\u00e1t klikni na exportovan\u00fd certifik\u00e1t (<code>.cer<\/code> s\u00fabor).<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"401\" height=\"513\" src=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-26.png\" alt=\"Step 2: Nasadenie certifik\u00e1tu do klientsk\u00fdch zariaden\u00ed\" class=\"wp-image-1391\" srcset=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-26.png 401w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-26-235x300.png 235w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-26-9x12.png 9w\" sizes=\"auto, (max-width: 401px) 100vw, 401px\" \/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li>Klikni na tla\u010didlo <strong>In\u0161talova\u0165 certifik\u00e1t<\/strong>.<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"533\" height=\"520\" src=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-27.png\" alt=\"Step 2: Nasadenie certifik\u00e1tu do klientsk\u00fdch zariaden\u00ed (2)\" class=\"wp-image-1392\" srcset=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-27.png 533w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-27-300x293.png 300w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-27-12x12.png 12w\" sizes=\"auto, (max-width: 533px) 100vw, 533px\" \/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li>Zvo\u013e mo\u017enos\u0165 <strong>Lok\u00e1lny po\u010d\u00edta\u010d<\/strong> (vy\u017eaduje administr\u00e1torsk\u00e9 pr\u00e1va).<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"528\" height=\"521\" src=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-28.png\" alt=\"Step 2: Nasadenie certifik\u00e1tu do klientsk\u00fdch zariaden\u00ed (3)\" class=\"wp-image-1393\" srcset=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-28.png 528w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-28-300x296.png 300w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-28-12x12.png 12w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-28-70x70.png 70w\" sizes=\"auto, (max-width: 528px) 100vw, 528px\" \/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li>Zvo\u013e mo\u017enos\u0165 <strong>Umiestni\u0165 v\u0161etky certifik\u00e1ty do nasledovn\u00e9ho \u00falo\u017eiska<\/strong>.<\/li>\n\n\n\n<li>Vyber <strong>D\u00f4veryhodn\u00e9 kore\u0148ov\u00e9 certifika\u010dn\u00e9 autority<\/strong>.<\/li>\n\n\n\n<li>Dokon\u010di in\u0161tal\u00e1ciu.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Po tomto kroku bude Windows aj jeho prehliada\u010de (Chrome, Edge) d\u00f4verova\u0165 MITM certifik\u00e1tom vygenerovan\u00fdm firewallom.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Step 3: Aktiv\u00e1cia in\u0161pekcie<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\u2611 Enable HTTPS Inspection<\/strong> \u2013 t\u00fdmto sa HTTPS Inspection skuto\u010dne aktivuje.<\/li>\n\n\n\n<li><strong>Deployment Mode<\/strong>:\n<ul class=\"wp-block-list\">\n<li><strong>Full inspection<\/strong> \u2013 v\u0161etka outbound HTTPS komunik\u00e1cia bude de\u0161ifrovan\u00e1 a analyzovan\u00e1 (produk\u010dn\u00fd re\u017eim).<\/li>\n\n\n\n<li><strong>Learning mode<\/strong> \u2013 len vzorka prenosu sa analyzuje bez z\u00e1sahu, sl\u00fa\u017ei na testovanie vplyvu a kompatibility.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n<h1 class=\"wp-block-heading\">Krok 3: Definovanie pravidiel v Outbound HTTPS Inspection Policy<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">T\u00e1to sekcia umo\u017e\u0148uje nastavi\u0165 <strong>presn\u00e9 pravidl\u00e1<\/strong>, pod\u013ea ktor\u00fdch Check Point rozhodne, \u010di m\u00e1:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>komunik\u00e1ciu <strong>de\u0161ifrova\u0165 a analyzova\u0165<\/strong> (<code>Inspect<\/code>),<\/li>\n\n\n\n<li>alebo ju ponecha\u0165 <strong>bez z\u00e1sahu<\/strong> (<code>Bypass<\/code>).<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"408\" src=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-22-1024x408.png\" alt=\"Step 3: Aktiv\u00e1cia in\u0161pekcie\" class=\"wp-image-1387\" srcset=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-22-1024x408.png 1024w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-22-300x119.png 300w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-22-768x306.png 768w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-22-1536x612.png 1536w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-22-18x7.png 18w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-22.png 1597w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\">Vysvetlenie pol\u00ed v tabu\u013eke:<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Pole<\/th><th>V\u00fdznam<\/th><\/tr><\/thead><tbody><tr><td><strong>No.<\/strong><\/td><td>Poradie pravidla \u2013 pravidl\u00e1 sa vyhodnocuj\u00fa zhora nadol.<\/td><\/tr><tr><td><strong>Name<\/strong><\/td><td>N\u00e1zov pravidla.<\/td><\/tr><tr><td><strong>Source<\/strong><\/td><td>Zdroj \u2013 zvy\u010dajne <em>Any<\/em>, teda ak\u00fdko\u013evek intern\u00fd klient.<\/td><\/tr><tr><td><strong>Destination<\/strong><\/td><td>Cie\u013e \u2013 \u010dasto <em>Internet<\/em>, \u010do znamen\u00e1 ak\u00e9ko\u013evek extern\u00e9 spojenie.<\/td><\/tr><tr><td><strong>Services<\/strong><\/td><td>Typ slu\u017eby (napr. HTTPS, HTTP_and_HTTPS_proxy at\u010f.).<\/td><\/tr><tr><td><strong>Category \/ Custom Apps<\/strong><\/td><td>Webov\u00e9 kateg\u00f3rie alebo aplik\u00e1cie, ktor\u00e9 sa pravidlom riadia.<\/td><\/tr><tr><td><strong>Action<\/strong><\/td><td>\u010co sa m\u00e1 s komunik\u00e1ciou urobi\u0165: <code>Inspect<\/code> alebo <code>Bypass<\/code>.<\/td><\/tr><tr><td><strong>Track<\/strong><\/td><td>Z\u00e1znam do logu.<\/td><\/tr><tr><td><strong>Install On<\/strong><\/td><td>Na ktor\u00fa gateway (VSX) sa pravidlo in\u0161taluje.<\/td><\/tr><tr><td><strong>Comment<\/strong><\/td><td>Pozn\u00e1mky \u2013 \u010dasto uv\u00e1dzaj\u00fa d\u00f4vod v\u00fdnimky alebo odkazy na politiku.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Na spodku je uveden\u00e9:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Unmatched traffic will be bypassed.<\/strong><\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">To znamen\u00e1, \u017ee <strong>ak sa komunik\u00e1cia nezhoduje so \u017eiadnym pravidlom v tejto politike<\/strong>, bude <strong>automaticky vy\u0148at\u00e1 z in\u0161pekcie<\/strong>. Preto je d\u00f4le\u017eit\u00e9 ma\u0165 <strong>&#8220;defaultn\u00e9 pravidlo&#8221; ako posledn\u00e9<\/strong> \u2013 s akciou <code>Inspect<\/code>, aby ni\u010d neuniklo kontrole.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Zhrnutie odpor\u00fa\u010dan\u00e9ho postupu:<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Za\u010dni v\u00fdnimkami<\/strong> \u2013 definuj, \u010do sa nem\u00e1 in\u0161pektova\u0165 (napr. banky, zdravotn\u00edctvo, vl\u00e1da).<\/li>\n\n\n\n<li><strong>Zadefinuj konkr\u00e9tne kateg\u00f3rie, ktor\u00e9 sa musia kontrolova\u0165<\/strong> (napr. pornografia, hazard, anonymiz\u00e9ry).<\/li>\n\n\n\n<li><strong>Pridaj posledn\u00e9 pravidlo <code>Inspect Any<\/code><\/strong>, aby bolo v\u0161etko ostatn\u00e9 pod kontrolou.<\/li>\n\n\n\n<li>Sleduj logy a testuj kompatibilitu \u2013 niektor\u00e9 aplik\u00e1cie nemusia znies\u0165 de\u0161ifrovanie (napr. niektor\u00e9 VPN klienty, bankov\u00e9 port\u00e1ly).<\/li>\n<\/ol>\n\n\n\n<h1 class=\"wp-block-heading\">Krok 4: Overenie a sledovanie HTTPS Inspection cez logy<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Po zapnut\u00ed in\u0161pekcie a nastaven\u00ed pravidiel je nevyhnutn\u00e9 <strong>monitorova\u0165 jej \u010dinnos\u0165 cez logy<\/strong>, ktor\u00e9 poskytuj\u00fa detailn\u00fd preh\u013ead o de\u0161ifrovanej komunik\u00e1cii a detekovan\u00fdch hrozb\u00e1ch.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"510\" src=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-24-1024x510.png\" alt=\"Zhrnutie odpor\u00fa\u010dan\u00e9ho postupu:\" class=\"wp-image-1389\" srcset=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-24-1024x510.png 1024w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-24-300x149.png 300w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-24-768x383.png 768w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-24-1536x765.png 1536w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-24-18x9.png 18w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-24.png 1586w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\">Overenie spr\u00e1vnej funk\u010dnosti na klientovi<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Po importe CA certifik\u00e1tu do syst\u00e9mu je d\u00f4le\u017eit\u00e9 overi\u0165, \u017ee:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>HTTPS komunik\u00e1cia je zachyt\u00e1van\u00e1 firewallom (MITM funguje)<\/strong>.<\/li>\n\n\n\n<li><strong>Pou\u017e\u00edvate\u013e nevid\u00ed \u017eiadne varovania v prehliada\u010di<\/strong>.<\/li>\n\n\n\n<li><strong>Certifik\u00e1t webovej str\u00e1nky je vydan\u00fd internou CA<\/strong> (teda tou, ktor\u00fa pou\u017e\u00edva Check Point).<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h4 class=\"wp-block-heading\">Ako overi\u0165 funk\u010dnos\u0165:<\/h4>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Otvor v prehliada\u010di HTTPS str\u00e1nku, napr\u00edklad <code>https:\/\/www.youtube.com<\/code>.<\/li>\n\n\n\n<li>Klikni na <strong>z\u00e1mok<\/strong> ved\u013ea URL adresy a zobraz detail o zabezpe\u010den\u00ed.<\/li>\n\n\n\n<li>Uvid\u00ed\u0161 nie\u010do ako: \u2705 <strong>You are securely connected to this site.<\/strong><br>\ud83d\udd12 <strong>Verified by: fw-xyz.localdomain<\/strong><br>\u2139\ufe0f <em>&#8220;Mozilla does not recognize this certificate issuer. It may have been added from your operating system or by an administrator.&#8221;<\/em><\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"433\" height=\"282\" src=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-29.png\" alt=\"Ako overi\u0165 funk\u010dnos\u0165:\" class=\"wp-image-1394\" srcset=\"https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-29.png 433w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-29-300x195.png 300w, https:\/\/virtualall.sk\/wp-content\/uploads\/2025\/07\/obrazek-29-18x12.png 18w\" sizes=\"auto, (max-width: 433px) 100vw, 433px\" \/><\/figure>\n<\/div>\n\n\n<h4 class=\"wp-block-heading\">\u010co to znamen\u00e1?<\/h4>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prehliada\u010d rozpoznal, \u017ee certifik\u00e1t <strong>nepoch\u00e1dza od glob\u00e1lnej verejnej CA<\/strong>, ale od <strong>internej CA<\/strong>, ktor\u00fa vygeneroval Check Point.<\/li>\n\n\n\n<li>Zobrazenie <strong>&#8220;Verified by: fw-[n\u00e1zov]&#8221;<\/strong> znamen\u00e1, \u017ee TLS spojenie bolo MITM zachyten\u00e9 a <strong>nov\u00fd certifik\u00e1t bol spr\u00e1vne vygenerovan\u00fd a akceptovan\u00fd klientom<\/strong>.<\/li>\n\n\n\n<li>Firefox zobraz\u00ed dodato\u010dn\u00e9 info o tom, \u017ee certifik\u00e1t nepozn\u00e1 \u2013 <strong>\u010do je v poriadku<\/strong>, pokia\u013e ho klient akceptuje a nezobrazuje chybu.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">S\u00favisiace n\u00e1vody<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"https:\/\/virtualall.sk\/2025\/09\/check-point-vsx-a-nastavenie-dhcp-relay\/\">Check Point VSX DHCP Relay &#8211; Konfigur\u00e1cia<\/a><\/li>\n\n\n<li><a href=\"https:\/\/virtualall.sk\/2022\/08\/checkpoint-zvecsenie-particie-log\/\">Check Point zv\u00e4\u010d\u0161enie part\u00edcie log<\/a><\/li>\n\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Tento \u010dl\u00e1nok sa venuje t\u00e9me in\u0161pekcie \u0161ifrovanej komunik\u00e1cie (HTTPS Inspection) a jej praktickej implement\u00e1cii v korpor\u00e1tnom prostred\u00ed prostredn\u00edctvom bezpe\u010dnostnej platformy Check Point. V \u00favode je \u010ditate\u013eovi objasnen\u00fd v\u00fdznam tejto technol\u00f3gie: zatia\u013e \u010do \u0161ifrovanie HTTPS poskytuje d\u00f4vernos\u0165 medzi klientom a serverom, z\u00e1rove\u0148 predstavuje v\u00fdzvu pre bezpe\u010dnostn\u00e9 mechanizmy, ktor\u00e9 bez de\u0161ifrovania nedok\u00e1\u017eu zisti\u0165, \u010do sa v d\u00e1tovom prenose re\u00e1lne odohr\u00e1va. Pr\u00e1ve preto je d\u00f4le\u017eit\u00e9, aby podniky nasadzovali HTTPS Inspection a mali tak vidite\u013enos\u0165 aj nad \u0161ifrovan\u00fdm prenosom.<\/p>\n<p>\u010cl\u00e1nok n\u00e1sledne vysvet\u013euje, \u010do v\u0161etko m\u00f4\u017ee by\u0165 pomocou tejto technol\u00f3gie detekovan\u00e9 \u2013 od malv\u00e9ru ukryt\u00e9ho v HTTPS spojeniach, cez komunik\u00e1ciu s C&#038;C servermi a\u017e po pr\u00edstup na podozriv\u00e9 alebo zak\u00e1zan\u00e9 webov\u00e9 str\u00e1nky. D\u00f4le\u017eit\u00fdm benefitom je tie\u017e mo\u017enos\u0165 uplatnenia firemn\u00fdch polit\u00edk na webov\u00fd obsah, \u010do pom\u00e1ha zabezpe\u010di\u0165 s\u00falad s legislat\u00edvou a vn\u00fatorn\u00fdmi predpismi (napr. GDPR, NIS2, ISO 27001).<\/p>\n","protected":false},"author":1,"featured_media":1401,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[83],"tags":[220,229,227],"class_list":["post-1384","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-checkpoint","tag-check-point-firewall","tag-check-point-https-inspection","tag-decrypt-https-traffic"],"_links":{"self":[{"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/posts\/1384","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/comments?post=1384"}],"version-history":[{"count":9,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/posts\/1384\/revisions"}],"predecessor-version":[{"id":2427,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/posts\/1384\/revisions\/2427"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/media\/1401"}],"wp:attachment":[{"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/media?parent=1384"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/categories?post=1384"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/tags?post=1384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}