10-27-2020 08:22 AM
Since all public CA's are not supported for decryption. How can we skip the decryption rule for those not supported so we have less tickets and lesser bad reputation. We can't have the list of all the websites from these unsupported CA's.
10-27-2020 08:58 AM
What I did was create a Custom URL Category, Lets call it "SLL work arounds". I then apply that in my decryption policy, lets call that "No-decrypt work around". Make sure you go to the Options tab for the rule and set it to "No Decrypt", and set the Custom URL in the Service/URL catagory tab. So when I come across a site that doesn't decrypt properly, I just add the url to the "SSL Work arounds" policy. So say www.badSSLplayer.com is throwing a browser warning, i'll add *.badSSLplayer.com to the list.
Just another I.T. Guy
10-27-2020 10:22 AM
@VincentPresogna I am also doing the same and bypassing decryption for those I come across. The issue is for our organization we can't limit access much to what users can access, and the userbase is also large. The decryption issue with websites keep popping almost everyday for some particular CA's, although it was implemented 8 months ago. Users don't mind if it happens once in a while, but if it keeps happening everybody including management looks as if we don't know what we are doing.
10-27-2020 10:32 AM - edited 10-27-2020 10:34 AM
@raji_toor I see we are in the same boat then, so to speak. Luckily for me, my user base is relatively small and rarely come across this issue much any more since I implemented decryption. Would be nice if maybe there was an EDL that could do this. But this poses the question, how to populate the EDL FQDN's of known decryption offenders.
Just another I.T. Guy
10-27-2020 10:42 AM
@VincentPresogna you can use domain url list for EDL, that eases the operation but still it still is an issue not knowing what domains to be added. This is why if it can be done on the basis of a CA would be nicer.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!