Exclude certificates generated by a third party CA from being decrypted

Reply
Highlighted
L4 Transporter

Exclude certificates generated by a third party CA from being decrypted

Hello,

The use is very simple : many government agencies (social security, tax collecters...) are using SSL websites signed with own CA (which is great for their own security) but creates many problems with PA decryption.

Is there a way configure PaloAlto to exclude from Decryption of certicates generated by a list of third-party CAs I would feed by myself ?

Thank you for your time

Tags (2)
Highlighted
L6 Presenter

Why not download their public root cert and import it as a trusted authority in your PA so it will successfully decrypt their traffic (because traffic coming from a gov site doesnt necessary mean that it is clean :smileyhappy:)

Otherwise you can add excludes to a "whitelist" in the PA (listed at )

Unfortunately I dont currently recall what the CLI command is for that...

Highlighted
L4 Transporter

Hello,

I don't trust them but :

  1. If I trust their CA, they could sign anything that my user would think is leggit website. And I am 100% sure that they don't take any special measures to protect their CAs . I still want websites to remain untrusted for browser, which is not possible if PA trusts their CA.
  2. "Otherwise you can add excludes to a "whitelist" in the PA (listed at List of Applications Excluded from SSL Decryption )" <-- doing such thing means that hackers will get the habbit to use websites that are like  site1.gov.co.uk with selfsigned certicates because they know they aren't inspected : applications ignored by SSL Decryption in this case aren't checked against known CAs
  3. Usually , tools provided by these organization are checking that the certificate of website/webapp is signed by their internal CA.
  4. Also, these tools are often using Client certificates , which makes Decryption impossible.


For all these reasons, the only viable possibility is to allow to ignore SSL Decryption when cert is signed by a list third party CA that would be fed by customer. Decryption Policy panel and stack needs a real big revamp to be usable (in addtion of TLS proper implementation)

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!