Sectigo CA Chain Decryption Issues

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Sectigo CA Chain Decryption Issues

L0 Member

Due to the recent expiration of the Sectigo RSA CA cert ( and our Palo firewall SSL decryption policy configuration to block expired certificates we are noticing that any website that is publishing the old expired CA chain (for example is being blocked due to them publishing an expired cert.


This is obviously working as expected however it's difficult for me to come into contact with each website hosting one of these invalid CA chains to get them to resolve the issue while our users experience issues and I manually exclude the sites from decryption.  I of course could turn off expired certificate blocking however this something I would rather not do.


I have noticed that web browsers like Chrome when not running through decryption are handling this issue just fine as they seem to look up the new correct CA certificate themselves and use that.  Is there a way I can configure out Palo to act in the same way or am I stuck being reliant on the web admins of the individual sites to correct their chain issues?


This is an issue for us too.   Why isn't Palo updating these?   Does the palo check all the chains for these, apparently Sectigo is saying that the cross signed certificate is enough to stop an error for these?

From PA Support


"From a quick search, I was able to see that multiple issues have been reported with respect to Sectigo Certificates Expiration.

As a workaround,you can either allow untrust cert or exclude the website from decryption which is causing issue.

PA has updated with the latest CA certification, so as of now no action needed on PA certificate store. If server chain is not updated till now then that might cause issue here.

Please let me know if you have any further queries or concerns regarding the case."


Awaiting their guidance on why the store is not up to date.




L2 Linker

According to this twitter thread, the issue is with how OpenSSL handles (or doesn't handle) validating certificate chains. I believe that the PAN firewalls use OpenSSL for certificate validations which is why the firewall fails to see that the server's certificate is actually valid.


As a workaround, this is what we did:

  1. Create a custom URL category "Expired Certificate Bypass"
    Objects > Custom Objects > URL Category
  2. Clone the decryption profile object and uncheck "Block sessions with expired certificates"
    Objects > Decryption > Decryption Profile
  3. Clone the decryption rule and use the new decryption profile and url category you just created
    Policies > Decryption

This is not ideal or scalable but it works for business critical sites.

L1 Bithead

We had been running with a separate exclusion list, our helpdesk became overwhelmed with requests and cert issues. As of this post we have disabled "Block sessions with expired certificates"


Monitoring this discussion for further updates. 


I will do exactly the same "Benlangberg"

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!