AWS PA, error on SSL forward decrypt

christian_pacher — Wed, 12 Jul 2023 12:26:27 GMT

Dear all

I am trying to configure SSL inspection on a Palo Alto in AWS.

Despite the configuration with client certificate and device CA and SubCA is (as far as I can verify) the same as the one on the on-premises environment, I still get errors like.

Received a fatal warning CertificateUnknown from the client.

Received a fatal warning UnknownCA from the client

PanOS is 10.2.4-h2

still tried this but cannot be the solution (and it does not help at all)

Repair Incomplete Certificate Chains (paloaltonetworks.com)

on reddit is a similar article but following this,the issue should be solved with PanOS10.2.3

Re: AWS PA, error on SSL forward decrypt

stevediaz — Sun, 23 Jul 2023 18:22:36 GMT

Hello

Please double-check the imported certificate chain, including the client certificate and all necessary intermediate/subordinate CAs, to ensure proper SSL inspection configuration. Verify that the CA issuing the client certificate is trusted on the Palo Alto device.

topic AWS PA, error on SSL forward decrypt in VM-Series in the Public Cloud

AWS PA, error on SSL forward decrypt

Re: AWS PA, error on SSL forward decrypt