Home
Support
Product Support
Security
Cisco Multicloud Defense
Configuration Guides

Cisco Multicloud Defense User Guide

Why does egress TLS inspection require a gateway self-signed certificate?
How can an FQDN service object override certificate validation defaults?
1. Why cannot the UI detect key mismatches when private keys stay in cloud storage?

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

Cisco Multicloud Defense User Guide

Why does egress TLS inspection require a gateway self-signed certificate?
How can an FQDN service object override certificate validation defaults?
1. Why cannot the UI detect key mismatches when private keys stay in cloud storage?

Expand all sections

About this content

About Multicloud Defense

Multicloud Defense
Multicloud Defense Components
Multicloud Defense Controller Dashboard
Multicloud Defense 90-Day Free Trial
Cloud Explorer

Setup with the Multicloud Defense Wizard

Connect Cloud Account
Enable Traffic Visibility
Secure Your Account

AWS

AWS Overview
Connect AWS Account to Multicloud Defense Controller from the Multicloud Defense Dashboard

Azure

Prepare Your Azure Account
Post-Onboarding Procedures

GCP

Connect a GCP Project to the Multicloud Defense Controller from the Multicloud Defense Dashboard

OCI

Prepare Your OCI Account
Connect the Oracle OCI Tenant to the Multicloud Defense Controller from the Multicloud Defense Dashboard

Remove a Cloud Service Provider From Multicloud Defense

Delete a GCP Project From Multicloud Defense
Delete an AWS Account From Multicloud Defense
Delete an Azure Account From Multicloud Defense
Delete an OCI Account From Multicloud Defense

AI Defense

AI Defense Integration with Multicloud Defense

Asset and Inventory Discovery

Discovery Summary
Inventory
Security Insights

Multicloud Defense Gateway and Service VPCs or VNets

Supported Gateway Use Cases
Configure Service VPCs and Service VNets
Configure Your Gateway

Site-to-Site VPN Tunnel Connection

Prerequisites and Limitations for Site-to-Site VPN Tunnels
Enable VPN Within the Gateway
Create a Site-to-Site VPN Connection
Edit a Site-to-Site VPN Tunnel
Clone a Site-2-Site VPN Tunnel Connection
Delete a VPN Tunnel Connection

Configure a Virtual Network Connection for Azure Virtual WAN

Overview of Virtual WAN
Guidelines for Virtual WAN Connections to Azure vHub
Create a Service VPC with a Virtual WAN Attachment
Modify a Service VPC with a Virtual WAN Attachment

Rules and Rule Sets

Policy Management
Rules
Rule Sets and Rule Set Groups

Objects

About the Multicloud Defense Connector
Import Objects From Security Cloud Control

Address Objects

Address Objects
Create a Source/Destination Address Object
Create a Reverse Proxy Target Address Object
Edit Address Objects
Clone Address Objects
Delete Address Object
View Details

FQDN Objects

FQDN Match Object

Service Objects

Reverse Proxy Service Object (Ingress)
Forward Proxy Service Object (Egress / East-West)
Forwarding Service Object (Egress / East-West)

Certificates and Keys

Certificates and Keys
Server Certificate Validation

Certificate and Keys Tech Notes

Azure Key Vault
Generate a Self-Signed Root CA
Generate a Certificate Signed by your Self-Signed Root CA
Generate an Intermediate CA Signed by Your Root CA
App Certificate signed using the Intermediate CA
Install Root CA as Trusted CA on the Hosts

Types of Traffic

Enable DNS Logs
Enable VPC Flow Logs

Security Profiles

Decryption Profile
Network Intrusion (IDS/IPS) Profile
Data Loss Prevention (DLP) Profile
Anti-Malware Profile
Web Application Firewall (WAF) Profile
URL (Uniform Resource Locator) Filter Profile
Fully Qualified Domain Name Filter Profile
Malicious IP Profile

Gateway Profiles

Packet Capture Profile
Log Forwarding Profile
Gateway Metrics Forwarding Profile
(Preview Only) Network Packet Broker Profile
Network Time Protocol Profile
IPSec Profile
BGP Profile

Profile Actions

View a Profile Details
Add a Gateway Association to a Profile
Remove a Gateway Association
Delete a Profile

FQDN and URL Filtering Categories

FQDN / URL Filtering Categories
Malicious Categories
Full List of Categories
Associating a Filtering Profile with a Policy Ruleset Rule
Cisco Talos Intelligence URL / IP Lookup Tool

Flow Analytics

Flow Analytics - Traffic Summary
Flow Analytics - All Events
Firewall Events
Network Threats
Web Attacks
URL Filtering
FQDN Filtering
HTTPS Logs
VPN Logs
EndUser Logs
HTTP2 Logs
Investigate summary page

Network Analytics

Stats

Audit and System Logs

Audit Logs
System Logs

Threat Research

Network Intrusion
Web Protection
Malicious Sources

Cloud Visibility Reports

Generate a Discovery Report
Generate a Threat And Cloud Analytics Report

Alerting Overview

Alert Services Overview

Alert Destinations / SIEMs

Datadog
Microsoft Sentinel
PagerDuty
ServiceNow
Slack
Microsoft Teams
Webex
Splunk

Log Forwarding Overview

Security Events and Traffic Logs
Discovery Logs
Gateway Metrics Forwarding Profile
Add an Event, Traffic Log Forwarding Profile, or Metrics Forward Profile to a Gateway
Remove an Event, Traffic Log Forwarding Profile, or Metrics Forward Profile from a Gateway

Log Forwarding Destinations / SIEMs

AWS S3 Bucket
Datadog
GCP Logging
Microsoft Sentinel
Splunk
Sumo Logic
Syslogs
Webhook

Management

Management
Alert Profiles

Manage Your Multicloud Defense Account

Account (Multicloud Defense Tenant)
Understand user roles in Security Cloud Control Firewall Management

Cloud Accounts

Cloud Accounts
Inventory

Compliance Certificates and Awards

Compliance Certificates

Troubleshoot Connecting Your Account

Manually Onboard an Account
Graceful Termination of Connections
Terraform Onboarding Scripts for Cloud Accounts

Cisco Multicloud Defense User Guide

Certificates and Keys

Updated: July 8, 2026

Secure Multicloud Defense with TLS certificates for ingress/egress. Import keys through AWS, GCP, Azure. Validate certificates in profiles/FQDNs.

Certificates and Keys

Learn how certificates and private keys support TLS inspection for ingress and egress proxy traffic, and review options for importing or securely storing private keys.

Server Certificate Validation

Learn when to validate server certificates for secure forward proxy traffic and where to configure validation actions for TLS-decrypted connections.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.