SSL decryption feature

[Amr_Attiya]

Hi All,

I wish to ask do i have to have my own Certificate in order to use SSL decryption feature, in order to decryption my users SSL traffic ?

OR i can just go and setup this feature and use it right away ?

I use PA-VM-100, PAN OS 6.0.4

[HULK]

Hello,

You have to use a certificate (either self-signed or from a third party) in order to decrypt SSL traffic on PAN firewall.

Few related DOC:

How to Implement SSL Decryption

SSL Decryption Certificates

Hope this helps.

Thanks

[pulukas]

Your client computers will need to "trust" the certificate you use on the PA for decryption or else they will get the red certificate error banner when browsing decrypted sites.

A simple way to achieve this on a windows domain is to use your Active Directory CA to issue the certificate you use for decryption on the PA.

[DavePalo]

Additionally, if you choose to use a non Active Directory CA you can use group policy to push the certificate trust out to workstations.