topic Re: Exclude certificates generated by a third party CA from being decrypted in General Topics

Exclude certificates generated by a third party CA from being decrypted

essnet — Wed, 19 Sep 2012 13:51:58 GMT

Hello,

The use is very simple : many government agencies (social security, tax collecters...) are using SSL websites signed with own CA (which is great for their own security) but creates many problems with PA decryption.

Is there a way configure PaloAlto to exclude from Decryption of certicates generated by a list of third-party CAs I would feed by myself ?

Thank you for your time

Re: Exclude certificates generated by a third party CA from being decrypted

mikand — Wed, 19 Sep 2012 19:54:27 GMT

Why not download their public root cert and import it as a trusted authority in your PA so it will successfully decrypt their traffic (because traffic coming from a gov site doesnt necessary mean that it is clean )

Otherwise you can add excludes to a "whitelist" in the PA (listed at )

Unfortunately I dont currently recall what the CLI command is for that...

Re: Exclude certificates generated by a third party CA from being decrypted

essnet — Thu, 20 Sep 2012 08:14:06 GMT

Hello,

I don't trust them but :

If I trust their CA, they could sign anything that my user would think is leggit website. And I am 100% sure that they don't take any special measures to protect their CAs . I still want websites to remain untrusted for browser, which is not possible if PA trusts their CA.
"Otherwise you can add excludes to a "whitelist" in the PA (listed at List of Applications Excluded from SSL Decryption )" <-- doing such thing means that hackers will get the habbit to use websites that are like site1.gov.co.uk with selfsigned certicates because they know they aren't inspected : applications ignored by SSL Decryption in this case aren't checked against known CAs
Usually , tools provided by these organization are checking that the certificate of website/webapp is signed by their internal CA.
Also, these tools are often using Client certificates , which makes Decryption impossible.

For all these reasons, the only viable possibility is to allow to ignore SSL Decryption when cert is signed by a list third party CA that would be fed by customer. Decryption Policy panel and stack needs a real big revamp to be usable (in addtion of TLS proper implementation)