Skip decryption for a certificate chain

[raji_toor]

Since all public CA's are not supported for decryption. How can we skip the decryption rule for those not supported so we have less tickets and lesser bad reputation. We can't have the list of all the websites from these unsupported CA's. 

[BPry]

@raji_toor,

I definitely wouldn't whitelist based off of URL unless you actually have a valid reason to do so, it simply takes too much time. If you run into a CA that isn't natively trusted by the firewall you can still import the CA's certs as a trusted CA which will allow you to bypass this issue. I would only actually whitelist based off of the actual domain if you don't actually trust the CA for whatever reason.

[raji_toor]

@BPry  I have tried importing the cert, and it doesn't always work.

[raji_toor]

@BPry Just as an example.. When logged in on support.dell.com and clicking an open SR gives the SSL error on (https://pf.us.dell.com/). I have imported both

'Entrust Certification Authority - L1K'

'Entrust Root Certification Authority - G2'

As i remember PA does not support Entrust, and this is also one of the reason for firewall to not do decryption on all Entrust issued certificate websites. We should have the capability to make that choice.