Provision of the PAC at the WebGateway via HTTPS

[AlexanderW]

We are hosting our proxy PAC file on the McAfee Web Gateway.

Currently, we are calling "http://proxy.domain.local/proxy.pac" to get the PAC file.
This procedure works fine.

I would like to ask if it is possible to get the PAC file through HTTPS
(->"https://proxy.domain.local/proxy.pac").

My efforts so far:
I added a new entry for the listener port (see Screenshot_1.png).
With this entry, I can connect to the Web Gateway but I got a status code 400 in rule tracing (Screenshot_2.png).
I am aware of the procedure of how SSL is working.
Using Wireshark I can see that my client is sending a "client hello" but the server did not send the "server hello" message.
I am sure that this is because I did not tell the Web Gateway to do this.

Is there any documentation that describes setting up the delivery of files over HTTPS on the WebGateway from the start?

[jacek]

First of all you have to setup a file server on HTTPS: Configuration - Applicance - File Server, select:
Enable dedicated file server port over HTTPS: 4714
On Port Forwarding page, add new forward from target port 443 to destination IP and destination port 4714.

After this, you should be able to access web server on MWG over HTTPS.

For more info see https://kc.mcafee.com/agent/index?page=content&id=KB68998

[AlexanderW · Accepted solution]

I found a solution that works for me.
Thanks to @aloksard, @Former Member and richard. 

I did the following steps:

Configuration > Appliance > Proxies
The "Ports treated as SSL" on Listener 0.0.0.0:443 have to be a * (star).

Configuration > Appliance > File Server
Ticked "Enable dedicated file server port over HTTPS" and inserted 127.0.0.1:4714 as HTTPS connector.

Policy > Lists > NextHopProxy
Added a new entry (Host: 127.0.0.1; Port 4714)

Policy > Settings > Next Hop Proxy
Added a new entry (select List from the step before)

Policy > Rule Sets
Added a new Ruleset for HTTPS

• On top of the rulset I added
  • Enable SSL Client Context with CA
  • Enable SSL Scanner (content inspection)
• request cycle events (sub ruleset 1)
  • Set URL.Path = "/files/proxy2.pac"
  • Enable Next Hop Proxy = "Next Hop Proxy Setting from step before"
• responses & embedded cycle (sub ruleset 2)
  • response of file like on HTTP