10-27-2020 08:22 AM
Since all public CA's are not supported for decryption. How can we skip the decryption rule for those not supported so we have less tickets and lesser bad reputation. We can't have the list of all the websites from these unsupported CA's.
10-27-2020 12:11 PM
I definitely wouldn't whitelist based off of URL unless you actually have a valid reason to do so, it simply takes too much time. If you run into a CA that isn't natively trusted by the firewall you can still import the CA's certs as a trusted CA which will allow you to bypass this issue. I would only actually whitelist based off of the actual domain if you don't actually trust the CA for whatever reason.
10-30-2020 08:33 AM
10-30-2020 09:24 AM
@BPry Just as an example.. When logged in on support.dell.com and clicking an open SR gives the SSL error on (https://pf.us.dell.com/). I have imported both
'Entrust Certification Authority - L1K'
'Entrust Root Certification Authority - G2'
As i remember PA does not support Entrust, and this is also one of the reason for firewall to not do decryption on all Entrust issued certificate websites. We should have the capability to make that choice.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!