Seeing user Data by PCAP and SSL decryption

[MP18]

Need to know can we see or scan user Data if we do PCAP on the SSL decrypted traffic?

[Raido_Rattameister]

pcap is encrypted even if traffic is decrypted by Palo but Wireshark allows you to decrypt it if you have correct cert...

[Brandon_Wertz · Accepted solution]

The SSL decryption which occurs on the firewall doesn't allow you to create pcaps that you would be able to see unencrypted. You can however SSL "mirror" the decrypted SSL traffic which would then allow you to create the unencrypted pcaps

[MP18]

which cert we need to see the contents of traffic which is ssl decrypted via pcap?