topic Re: Outbound SSL Decryption Quirk in Next-Generation Firewall Discussions

Outbound SSL Decryption Quirk

RH747 — Fri, 03 Oct 2025 17:14:56 GMT

Hello,

I have established an outbound SSL decrypt policy that I have enabled for only myself as I test functionality. Over the past few months, I've noticed a quirk that I'm unsure of the reasoning behind. With the policy enabled, sometimes connections to certain destinations will require a reload of the webpage to establish connection.

For example:

Navigate to a knowledgebase for a vendor - failed to establish connection upon first attempt
Reload the webpage - successfully establish connection

This behavior is exclusive to when I have the decrypt policy enabled so I'm fairly certain that I am pointing the finger at the correct culprit. It seems a problematic destination is random, as it's not always the same sites and varies between days/weeks on occurrence.

The work around of simply refreshing the page is easy enough, my concern is when I enable this for the company and users flood my inbox with this issue for various sites and I have to tell them all to refresh... seems half-baked.

My question is - Is this normal behavior for SSL decryption, or am I missing something within the configuration? I followed the best-practice guide released by Palo Alto.

Thanks!

Re: Outbound SSL Decryption Quirk

reaper — Mon, 06 Oct 2025 12:00:08 GMT

Have you checked the decrypt logs to see if something odd is happening the moment you notice a failed connection?

How did you configure your decryption profile, did you limit your SSL Protocol Settings ?

Re: Outbound SSL Decryption Quirk

RH747 — Mon, 06 Oct 2025 14:53:23 GMT

I have checked the logs when it has happened in the past and don't see anything that consistently shows each time and it's a somewhat rare occurrence, so I don't have much to go off of with only 1 user testing. Initially I thought maybe it was an OCSP/CRL delay, but that's uncertain without logs to correlate the thought. I was hoping someone has experienced this and narrowed their findings to something specific I could check!

The profile is mostly configured to PA recommended best practice; the minimum protocol is set to 1.2 with maximum set to max. I do not have the failure checks or strip APLN enabled. Certificate used is firewall generated.