possibility of secure MQTT's decryption at Palo alto firewall

[NetSecFirewall]

how can we decrypt MQTT's port 8883 traffic at palo alto firewall, or is it possible.

[kiwi]

Hi @NetSecFirewall ,

The answer is nuanced because you don't provide a lot of info.

As far as I know MQTT can be decrypted normally on PANW in its default setup.  Secure communication is enabled by using Transport Layer Security (TLS), which can then be enhanced with certificate pinning (or fingerprint validation) for additional security against man-in-the-middle attacks (in which case decryption will not be possible). 

Some websites are misconfigured and will not send complete certificate chains (up to root) which is according to RFC standard. The firewall has only root certificates in its "Default Trusted Certificate Authorities" store. In case an intermediate certificate is missing from the certificate list presented by the server, the firewall will not be able to construct the chain to the root and will present the "Forward Untrust Certificate" to the client when decryption is enabled https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/troubleshoot-and-monitor-decry... 

As per the DOC above there are some steps you can perform to resolve that problem.

1.Filter the Decryption log to identify Decryption sessions that failed because of an incomplete certificate chain.

2.Copy and paste the URI into your browser and then press Enter to download the missing intermediate certificate.

3.Import the certificate into the firewall.

4.Select Trusted Root CA to mark the certificate as a Trusted Root CA on the firewall.

Kind regards,

-Kim.