06-11-2014 09:30 AM
For SSL Decryption does the cert on the PALO need to be issued from the same enterprise cert chain as the workstations, or does the cert on the workstation have to match the cert on the PALO exactly? We have about 2000 workstations that have been issued a unique cert already for other applications.
Thanks
Mark
06-12-2014 06:56 AM
For inbound decryption, the certificate needs to match the certificate on the web-server. For outbound decryption (SSL Forward Proxy), the certificate on the PA should be a sub-ordinate CA signed be your internal CA. You can also use a self-signed CA-certificate, but then this needs to be distributed to your clients as a trusted root ca.
You can get more info from this document: How to Implement SSL Decryption
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
