Commit error - vsys1 decryption: forward decrypt untrust cert is not configured

[Interface]

Hi,

This commit error: "Warning: vsys1 decryption: forward decrypt untrust cert is not configured, forward decrypt trust cert will be used instead." Means, that i must generate "Forward untrust certificate" or what?

[goku123]

Yes, you need to generate/import a CA cert on the PA and designate it as "Forward untrust cert" if you configure outbound SSL proxy as shown in the screenshot.

[kprakash]

Good Morning,

Its recommended that the users are presented with a forward untrust certificate, if the server certificate of the web site that the user browses for isnt part of the Trusted CA certificates in the firewall. This is to let the customer know that the website in question is not trusted or safe. Usually the PANFW has most of the CA certificates under its list, and for the ones that are not present, the PANFW considers them as being unsafe.

When configured with the forwared untrust certificate, the user can come to know that the website in question not a safe website

[mbutt]

Here is a doc which explains on how the different Decryptions (Inbound, outbound, forward proxy) is done on the firewall and general guidlines on how to configure it

https://live.paloaltonetworks.com/docs/DOC-1412

Here are few other useful docs for SSL decryption

https://live.paloaltonetworks.com/docs/DOC-2008

https://live.paloaltonetworks.com/docs/DOC-2006

Hope this helps.

Thanks
Numan