01-23-2022 03:01 PM
I am configuring SSL decryption on Palo Alto using a self-signed CA. I have created two certificates, one for forward trust and second for forward untrust. I have installed the forward trust certificate into the trusted root CA of the machine.
The issue is that I keep getting Your connection is not private message for all the sites that I am trying to access and looks like Palo is not trusting them and only issuing Untrust cert.
Is there anything I am missing?
Appreciate your response.
01-27-2022 04:56 AM
Hi @Zain_Chaudhry ,
Are you by any chance using a browser that has it's own certificate store (firefox for example) ? In that case, install the certificate in the browser certificate store.
Hope it helps,
01-27-2022 08:02 AM
In addition to what @kiwi mentioned, is it actually every site and does the firewall itself trust the root certificate of the website in question. Some countries I've had customers operating in actually have a root CA that you need to add into the firewall and add it as a trusted root CA as they perform their own inspection. You could also be visiting sites that are simply issued by root CAs not trusted by the firewall, and you'll likewise need to import the root CA and mark it as a trusted Root CA so the firewall actually trusts the certificate being presented by the website in question.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!