topic Re: Commit error - vsys1 decryption: forward decrypt untrust cert is not configured in General Topics

Commit error - vsys1 decryption: forward decrypt untrust cert is not configured

Interface — Tue, 27 Aug 2013 13:52:06 GMT

Hi,

This commit error: "Warning: vsys1 decryption: forward decrypt untrust cert is not configured, forward decrypt trust cert will be used instead." Means, that i must generate "Forward untrust certificate" or what?

Re: Commit error - vsys1 decryption: forward decrypt untrust cert is not configured

goku123 — Tue, 27 Aug 2013 13:54:46 GMT

Yes, you need to generate/import a CA cert on the PA and designate it as "Forward untrust cert" if you configure outbound SSL proxy as shown in the screenshot.

Re: Commit error - vsys1 decryption: forward decrypt untrust cert is not configured

kprakash — Tue, 27 Aug 2013 13:56:36 GMT

Good Morning,

Its recommended that the users are presented with a forward untrust certificate, if the server certificate of the web site that the user browses for isnt part of the Trusted CA certificates in the firewall. This is to let the customer know that the website in question is not trusted or safe. Usually the PANFW has most of the CA certificates under its list, and for the ones that are not present, the PANFW considers them as being unsafe.

When configured with the forwared untrust certificate, the user can come to know that the website in question not a safe website

Re: Commit error - vsys1 decryption: forward decrypt untrust cert is not configured

mbutt — Tue, 27 Aug 2013 23:07:25 GMT

Here is a doc which explains on how the different Decryptions (Inbound, outbound, forward proxy) is done on the firewall and general guidlines on how to configure it

https://live.paloaltonetworks.com/docs/DOC-1412

Here are few other useful docs for SSL decryption

https://live.paloaltonetworks.com/docs/DOC-2008

https://live.paloaltonetworks.com/docs/DOC-2006

Hope this helps.

Thanks
Numan