SSL decryption - Connection is not Private

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

SSL decryption - Connection is not Private

L0 Member

Hi Team,

I am configuring SSL decryption on Palo Alto using a self-signed CA. I have created two certificates, one for forward trust and second for forward untrust. I have installed the forward trust certificate into the trusted root CA of the machine.

The issue is that I keep getting Your connection is not private message for all the sites that I am trying to access and looks like Palo is not trusting them and only issuing Untrust cert.

Is there anything I am missing?

Appreciate your response.

Thanks,

2 REPLIES 2

Community Team Member

Hi @Zain_Chaudhry ,

 

Should work.

Are you by any chance using a browser that has it's own certificate store (firefox for example) ? In that case, install the certificate in the browser certificate store.

 

Hope it helps,

-Kiwi.

 

 

 
LIVEcommunity team member, CISSP
Cheers,
Kiwi
Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Cyber Elite
Cyber Elite

@Zain_Chaudhry,

In addition to what @kiwi mentioned, is it actually every site and does the firewall itself trust the root certificate of the website in question. Some countries I've had customers operating in actually have a root CA that you need to add into the firewall and add it as a trusted root CA as they perform their own inspection. You could also be visiting sites that are simply issued by root CAs not trusted by the firewall, and you'll likewise need to import the root CA and mark it as a trusted Root CA so the firewall actually trusts the certificate being presented by the website in question. 

  • 1980 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!