Reasons for Connections going to ssl decryption exclusion list

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Reasons for Connections going to ssl decryption exclusion list

Cyber Elite
Cyber Elite

 

Need to know PA which reasons it consider to put session in ssl decryption exclusion list?

one I know is client cert authentication and cert pinning.

 

also if ssl handshake does not complete will PA put connection in exclusion list?

MP

Help the community: Like helpful comments and mark solutions.
4 REPLIES 4

Cyber Elite
Cyber Elite

Generally, there are 3 reasons why sites are put on the exclusion list

 

Apps that use client side certificates
Non RFC compliant applications
Servers using unsupported cryptographic settings

 

The above is updated during software or content updates.

 

If SSL handshake does not occur, that would not be a reason to put it into the exclusion list.

Help the community: Like helpful comments and mark solutions

 

PA documentation shows cert pinning also.

I was talking to PA tech he told me if ssl handshake do not work then app is put into exclusion list.

 

It is hard to find the exact reason hopefully someone here chime in on this.

MP

Help the community: Like helpful comments and mark solutions.

 

can some one answer this please?

MP

Help the community: Like helpful comments and mark solutions.

@MP18 

 

I believe I had answered your question....

 

According to PANW

 

  • Some applications might not work with SSL Forward Proxy:
  • Applications that use client-side certificates
  • Non-RFC-compliant applications
  • Servers using unsupported cryptographic settings
Help the community: Like helpful comments and mark solutions
  • 2138 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!