topic ssl-decrypt exclude-cache ---SSL_CLIENT_CERT in General Topics

ssl-decrypt exclude-cache ---SSL_CLIENT_CERT

MP18 — Fri, 12 Oct 2018 17:41:33 GMT

when i run below command

show system setting ssl-decrypt exclude-cache

VSYS SERVER APP TIMEOUT REASON DECRYPTED_APP PROFILE EXCLUSION_LIST_MATCH

13.71.172.130:443 ssl 42077 SSL_CLIENT_CERT undecided default No

does this mean that PA can not decrypt the ssl traffic due to client cert?

what can be actual reason behind this?

Re: ssl-decrypt exclude-cache ---SSL_CLIENT_CERT

gwesson — Fri, 12 Oct 2018 17:46:18 GMT

That's correct. The "SSL_CLIENT_CERT" means that the site is doing certificate-based client authentication.

A client cert can't be spoofed because you cannot generate a client cert on the fly that matches the CA requested by the server, so the firewall adds it to the exclude cache.

Re: ssl-decrypt exclude-cache ---SSL_CLIENT_CERT

MP18 — Fri, 12 Oct 2018 17:47:28 GMT

Many thanks Sir!

Pleasure to get reply from you.