PANOS 4.1 error message: untrust cert is not configured

michael_schumak — Tue, 28 Feb 2012 22:23:12 GMT

When I have configured SSL decryption, I always get this warning message when I commit:

· Warning: vsys1 decryption: forward decrypt untrust cert is not configured, forward decrypt trust cert will be used instead.

· (Module: device)

· Configuration committed successfully

How can I get rid of this message when I haven't configured an SSL unrust certificate?

Mike

Re: PANOS 4.1 error message: untrust cert is not configured

mikand — Wed, 29 Feb 2012 09:01:06 GMT

Just ignore the warning (or contact your sales rep to file a feature request where one can setup which warnings you wish to ignore by default).

The warning is there to notify that you might have missed something that is commonly used when doing SSL-termination.

When you perform SSL-termination the PAN will setup and verify the SSL-session. In order to handle the case of "what to do if the SSL-session is invalid" PAN choosed to use the untrust cert method.

By setting up a dedicated "untrust cert" and place this as blacklisted untrusted issuers in your client browser the client will be notified that there is something wrong with the cert that the site uses which the client is trying to access.

For more information check https://live.paloaltonetworks.com/thread/4229?tstart=0

topic Re: PANOS 4.1 error message: untrust cert is not configured in General Topics

PANOS 4.1 error message: untrust cert is not configured

Re: PANOS 4.1 error message: untrust cert is not configured