Decryption failed

[HY_Cheng]

Hi guys , 

PA820 . OS Version 10.2.9-h1

I am try using the decryption function to see more application information
I generated the CA certificate from PA and imported it locally.

From the decryption log, I saw many errors with various URLs.
Can anyone help explain how to eliminate this?

error eq 'Received fatal alert CertificateUnknown from client. CA Issuer URL (truncated):http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1'
URL: http://aia.entrust.net/l1k-chain256.cer'

[CosminM]

Hello @HY_Cheng 

It seems like you're dealing with a classic incomplete chain issue.

This often occurs with SSL/TLS certificates when the server doesn't provide the full certificate chain, excluding the root certificate.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decry... 

[rmfalconer]

What exactly did you do when you generated the CA certificate from PA and imported in locally?

[HY_Cheng]

I followed the file settings, and the text did not mention the need for a complete certificate chain.

Only use self-signed CAs and choose to forward trust certificates

From the traffic log, I can see that the appplication can be identified, but I still see a similar error in the decryption log. Is it necessary to complete the credential chain for a specific connection to eliminate this problem?
Any ideas?

Thank you so much

https://knowledgebase-paloaltonetworks-com.translate.goog/KCSArticleDetail?id=kA10g000000ClmyCAC&_x_...

[HY_Cheng]

I followed the documentation settings, generated a self-signed CA and chose to forward the trust certificate
Import the local trusted root certificate authority and set the porfile/policy
Try to connect to check the traffic

https://knowledgebase-paloaltonetworks-com.translate.goog/KCSArticleDetail?id=kA10g000000ClmyCAC&_x_...

[rmfalconer]

What type of client are you using? Are they Windows machines? If so, when you browse the Trusted Root Certification Authorities store, do you see it there?