Skip decryption for a certificate chain

[raji_toor]

Since all public CA's are not supported for decryption. How can we skip the decryption rule for those not supported so we have less tickets and lesser bad reputation. We can't have the list of all the websites from these unsupported CA's. 

[VincentPresogna]

What I did was create a Custom URL Category, Lets call it "SLL work arounds". I then apply that in my decryption policy, lets call that "No-decrypt work around". Make sure you go to the Options tab for the rule and set it to "No Decrypt", and set the Custom URL in the Service/URL catagory tab. So when I come across a site that doesn't decrypt properly, I just add the url to the "SSL Work arounds" policy. So say www.badSSLplayer.com is throwing a browser warning, i'll add *.badSSLplayer.com to the list.

[raji_toor]

@VincentPresogna  I am also doing the same and bypassing decryption for those I come across. The issue is for our organization we can't limit access much to what users can access, and the userbase is also large. The decryption issue with websites keep popping almost everyday for some particular CA's, although it was implemented 8 months ago. Users don't mind if it happens once in a while, but if it keeps happening everybody including management looks as if we don't know what we are doing.

[VincentPresogna]

@raji_toor   I see we are in the same boat then, so to speak. Luckily for me, my user base is relatively small and rarely come across this issue much any more since I implemented decryption. Would be nice if maybe there was an EDL that could do this. But this poses the question, how to populate the EDL FQDN's of known decryption offenders.

[raji_toor]

@VincentPresogna you can use domain url list for EDL, that eases the operation but still it still is an issue not knowing what domains to be added. This is why if it can be done on the basis of a CA would be nicer.