SSL Decryption with Mutual (2 Way) Authentication

[ckawecki]

Hi,

I have traffic that uses mutual (2 way) SSL Authentication that I would like to decrypt. I was able to decrypt when just using the server certificate, but when I add the client certificate it no longer decrypts (the connection still works though).

I have look around the docs/site and have not seen much mention of this scenario. I would like to know if it is supported? If so, how do you configure it?

[panos]

Hi,

SSL decryption cannot be used when servers require client certificates.

[mikand]

You can however still use SSL inspection. That is give your PA device the private key of the server and the PA will be able to "tap" the traffic.

However I dont think this will work if the endpoints are using DH (Diffie Hellman).