Reasons for Connections going to ssl decryption exclusion list

[MP18]

Need to know PA which reasons it consider to put session in ssl decryption exclusion list?

one I know is client cert authentication and cert pinning.

also if ssl handshake does not complete will PA put connection in exclusion list?

[S.Cantwell]

Generally, there are 3 reasons why sites are put on the exclusion list

Apps that use client side certificates
Non RFC compliant applications
Servers using unsupported cryptographic settings

The above is updated during software or content updates.

If SSL handshake does not occur, that would not be a reason to put it into the exclusion list.

[MP18]

PA documentation shows cert pinning also.

I was talking to PA tech he told me if ssl handshake do not work then app is put into exclusion list.

It is hard to find the exact reason hopefully someone here chime in on this.

[MP18]

can some one answer this please?

[S.Cantwell]

@MP18 

I believe I had answered your question....

According to PANW

• Some applications might not work with SSL Forward Proxy:
• Applications that use client-side certificates
• Non-RFC-compliant applications
• Servers using unsupported cryptographic settings