SSL Outbound decryption - Outbound traffic

[ecesureshkumar]

Hi There, I need your inputs to implement SSL Decryption, currently we have Proxy Server - WSA and same is configured at all end users explicitly. WSA Doesn't have ssl decryption. Hence we would like to deploy ssl decryption at perimeter firewall palo alto. Please suggest how to implement the same and which certificate needs to be used. As i am new to ssl decryption, please suggest the same and share some documents  with step by step procedures. Thanking you.

[deepak12]

@ecesureshkumar 

Check below links ;

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmyCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEZCA0

[OGMaverick]

I'm not sure if maybe you just mean your WSA isn't doing decryption, but WSA does support it.  We had a rack of them that were also decrypting before we moved to PAN.

[ecesureshkumar]

Hi There,

In LAN We have more that 500 users, so what is the best practise to deploy SSL Decryption and install the certificates in client PC's.

That is do i need to generate CSR in Firewall and it needs to be Signed in Local Domain Controller. Please elebrote the same and throw some light on this.

[TSilverline]

The SSL certificate needs to be added to the Trusted Root Certification Authorities of all of your computers.  I'd just use a self signed one from the firewall, but you can also get puicly signed ones, etc.

This article covers the concept pretty well (I have no affiliation with Globalsign it just explains the concept well): https://www.globalsign.com/en/blog/what-is-ssl-inspection/

Regardless of which route you go, you will HAVE to push at least one certificate to get SSLi working.

If windows, the easiest way do deploy these is using GPO.

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/distribute-certificates-to...

If MAC or linux, youd need some sort of orchestration tool (JAMF, etc) to push globally.