SSL Decryption

[RC-BHF]

Hello

We have recentley tuned on SSL Decryption for some users.

Since then we are getting some SSL sites that cannot be accessed due to cypher mismatch. It is something we were exepcting, but not the amount of URL this is happneing for.

My question, is there a setting that I can turn on that will allow the site to be accessed if the SSL Decryption fails ?

My assumption is that most sites will get decrypted and we will get the relevant APP-id data from it.

Thanks

[santonic · Accepted solution]

You can decide what you want to do with sites that can't be decrypted in SSL forward proxy options in decryption profile:

Unsupported Mode Checks

Block sessions with unsupported versions

Block sessions with unsupported cipher suites

Block sessions with client authentication

[kiwi]

On the more recent PAN-OS versions, if a site is using an unsupported cipher then it is added automatically to the ssl-decrypt exclude cache and will no longer be decrypted :

SSL-decrypt-exclude-cache-and-unsupported-cipher-suites