Skip decryption for a certificate chain

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Skip decryption for a certificate chain

L4 Transporter

Since all public CA's are not supported for decryption. How can we skip the decryption rule for those not supported so we have less tickets and lesser bad reputation. We can't have the list of all the websites from these unsupported CA's. 



I definitely wouldn't whitelist based off of URL unless you actually have a valid reason to do so, it simply takes too much time. If you run into a CA that isn't natively trusted by the firewall you can still import the CA's certs as a trusted CA which will allow you to bypass this issue. I would only actually whitelist based off of the actual domain if you don't actually trust the CA for whatever reason.

@BPry  I have tried importing the cert, and it doesn't always work.

@BPry Just as an example.. When logged in on and clicking an open SR gives the SSL error on ( I have imported both

'Entrust Certification Authority - L1K'

'Entrust Root Certification Authority - G2'


As i remember PA does not support Entrust, and this is also one of the reason for firewall to not do decryption on all Entrust issued certificate websites. We should have the capability to make that choice.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!