topic Re: Reasons for Connections going to ssl decryption exclusion list in General Topics

Reasons for Connections going to ssl decryption exclusion list

MP18 — Sat, 16 Nov 2019 17:53:47 GMT

Need to know PA which reasons it consider to put session in ssl decryption exclusion list?

one I know is client cert authentication and cert pinning.

also if ssl handshake does not complete will PA put connection in exclusion list?

S.Cantwell — Sat, 16 Nov 2019 18:10:16 GMT

Generally, there are 3 reasons why sites are put on the exclusion list

Apps that use client side certificates
Non RFC compliant applications
Servers using unsupported cryptographic settings

The above is updated during software or content updates.

If SSL handshake does not occur, that would not be a reason to put it into the exclusion list.

MP18 — Sat, 16 Nov 2019 19:40:43 GMT

PA documentation shows cert pinning also.

I was talking to PA tech he told me if ssl handshake do not work then app is put into exclusion list.

It is hard to find the exact reason hopefully someone here chime in on this.

MP18 — Fri, 22 Nov 2019 03:14:05 GMT

can some one answer this please?

S.Cantwell — Fri, 22 Nov 2019 20:37:33 GMT

I believe I had answered your question....

According to PANW