Skip decryption for a certificate chain

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Skip decryption for a certificate chain

L4 Transporter

Since all public CA's are not supported for decryption. How can we skip the decryption rule for those not supported so we have less tickets and lesser bad reputation. We can't have the list of all the websites from these unsupported CA's. 


L3 Networker

What I did was create a Custom URL Category, Lets call it "SLL work arounds". I then apply that in my decryption policy, lets call that "No-decrypt work around". Make sure you go to the Options tab for the rule and set it to "No Decrypt", and set the Custom URL in the Service/URL catagory tab. So when I come across a site that doesn't decrypt properly, I just add the url to the "SSL Work arounds" policy. So say is throwing a browser warning, i'll add * to the list.


Just another I.T. Guy

@VincentPresogna  I am also doing the same and bypassing decryption for those I come across. The issue is for our organization we can't limit access much to what users can access, and the userbase is also large. The decryption issue with websites keep popping almost everyday for some particular CA's, although it was implemented 8 months ago. Users don't mind if it happens once in a while, but if it keeps happening everybody including management looks as if we don't know what we are doing.

@raji_toor   I see we are in the same boat then, so to speak. Luckily for me, my user base is relatively small and rarely come across this issue much any more since I implemented decryption. Would be nice if maybe there was an EDL that could do this. But this poses the question, how to populate the EDL FQDN's of known decryption offenders.


Just another I.T. Guy

@VincentPresogna you can use domain url list for EDL, that eases the operation but still it still is an issue not knowing what domains to be added. This is why if it can be done on the basis of a CA would be nicer.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!