Decryption Profile

[securehops]

I modified existing decryption rules to add a decryption profile to each of them.  In the profile, I have "Block sessions with untrusted issuers" checked.   I'm finding sites with well-known trusted certificates are being blocked due to this.  My understanding is Palo has a very limited certificate store.

What's the best/most common way to handle this?  

[kiwi]

Hi @securehops ,

I believe there are several steps you can try to improve the situation:

Ensure that your firewall's PAN-OS version is reasonably current so you have an updated CA list (PAN firewalls update their default trusted CA store primarily with major PAN-OS software releases).

Importing missing CAs over creating decryption exclusions (Use decryption exclusions only as a last resort for sites that genuinely break decryption or for specific business/regulatory reasons.)

Consider automating the CA trust store management with tools like pan-chainguard for a more proactive approach: 

https://pan.dev/panos/docs/pan-chainguard/

Hope this helps,

Kim.

[securehops]

Hi @kiwi 

Thanks for response.  I am running 11.1.x code

Seems that the need for customers to import missing CA's is common, from what I gather.  As you mention, I'd prefer not having to make decryption exceptions.  I also didn't want to be in the business of having to upload trusted root CAs and maintaining that list.   I was starting to wonder if a lot of customers leave these checkboxes unchecked in their decryption profiles