topic Where to find information about SSL decryption is (not) required to identified traffic in General Topics

Where to find information about SSL decryption is (not) required to identified traffic

A.Molter — Fri, 25 Jul 2025 14:39:02 GMT

Hello guys,

I want to know if there is a resource where I can find if SSL decryption is required or not to identified the APP traffic.

I have this information inside Palo Alto Networks Content Update mail but I don't find this information in applipedia or somewhere else.

Anybody have an idea ?

Best,

Alexis

Re: Where to find information about SSL decryption is (not) required to identified traffic

JayGolf — Mon, 28 Jul 2025 15:45:15 GMT

Hi @A.Molter ,

SSL Decryption is required for application traffic that is encrypted by SSL/TLS, if you would like to truly identify what the underlying application is. If you go onto your monitor tab and view traffic from your trust zone to the untrust zone, you will likely find a number of connections that have the app-id "ssl". Without decryption, you don't really know what type of application the connection is because the firewall can't inspect the encrypted payload. The employee could be watching a cnn video or a youtube video.

I would recommend taking a look at how much SSL traffic traverses any firewall you might have that sits at the edge. Head over to your ACC tab on your firewall. Then click on SSL activity and set the time frame to last 90 days. How much SSL traffic do you see? How does it compare to other traffic? There is all your application traffic that hides behind encryption.

I would recommend reading Decryption Basics and Decryption best practices.

Re: Where to find information about SSL decryption is (not) required to identified traffic

A.Molter — Tue, 29 Jul 2025 06:33:23 GMT

Hello @JayGolf ,

Thanks for all thoses advices.

But I just want to know if there is a documentation about what applications required decryption to be identified and what not.

I am surprised to find this information inside Palo Alto Networks Content Update newsletter but not in the applipedia.

This can be helpful to understand what applications can be block or allow in network without decryption.