topic SSL decryption - Connection is not Private in General Topics

SSL decryption - Connection is not Private

Zain_Chaudhry — Sun, 23 Jan 2022 23:01:09 GMT

Hi Team,

I am configuring SSL decryption on Palo Alto using a self-signed CA. I have created two certificates, one for forward trust and second for forward untrust. I have installed the forward trust certificate into the trusted root CA of the machine.

The issue is that I keep getting Your connection is not private message for all the sites that I am trying to access and looks like Palo is not trusting them and only issuing Untrust cert.

Is there anything I am missing?

Appreciate your response.

Thanks,

Re: SSL decryption - Connection is not Private

kiwi — Thu, 27 Jan 2022 12:56:42 GMT

Hi @Zain_Chaudhry ,

Should work.

Are you by any chance using a browser that has it's own certificate store (firefox for example) ? In that case, install the certificate in the browser certificate store.

Hope it helps,

-Kiwi.

Re: SSL decryption - Connection is not Private

BPry — Thu, 27 Jan 2022 16:02:03 GMT

@Zain_Chaudhry,

In addition to what @kiwi mentioned, is it actually every site and does the firewall itself trust the root certificate of the website in question. Some countries I've had customers operating in actually have a root CA that you need to add into the firewall and add it as a trusted root CA as they perform their own inspection. You could also be visiting sites that are simply issued by root CAs not trusted by the firewall, and you'll likewise need to import the root CA and mark it as a trusted Root CA so the firewall actually trusts the certificate being presented by the website in question.