topic Re: Decryption Profile in General Topics

Decryption Profile

securehops — Mon, 16 Jun 2025 18:37:02 GMT

I modified existing decryption rules to add a decryption profile to each of them. In the profile, I have "Block sessions with untrusted issuers" checked. I'm finding sites with well-known trusted certificates are being blocked due to this. My understanding is Palo has a very limited certificate store.

What's the best/most common way to handle this?

Re: Decryption Profile

kiwi — Tue, 17 Jun 2025 07:02:31 GMT

Hi @securehops ,

I believe there are several steps you can try to improve the situation:

Ensure that your firewall's PAN-OS version is reasonably current so you have an updated CA list (PAN firewalls update their default trusted CA store primarily with major PAN-OS software releases).

Importing missing CAs over creating decryption exclusions (Use decryption exclusions only as a last resort for sites that genuinely break decryption or for specific business/regulatory reasons.)

Consider automating the CA trust store management with tools like pan-chainguard for a more proactive approach:

https://pan.dev/panos/docs/pan-chainguard/

Hope this helps,

Kim.

Re: Decryption Profile

securehops — Wed, 18 Jun 2025 20:09:08 GMT

Hi @kiwi

Thanks for response. I am running 11.1.x code

Seems that the need for customers to import missing CA's is common, from what I gather. As you mention, I'd prefer not having to make decryption exceptions. I also didn't want to be in the business of having to upload trusted root CAs and maintaining that list. I was starting to wonder if a lot of customers leave these checkboxes unchecked in their decryption profiles