02-15-2022 07:21 AM
Hi @thompso104,
"Use a public CA as the forward trust cert which these devices should already trust" - this is very common misundertanding that I a met quite often... You cannot use public CA for forwarding trust certificate.
For Forwarding Trust Cert to work, you need the private key for that certificate. No public CA will give you their keys, because there will be nothing that can stop you and start signing certificates left and right from their behalf.
Unfortunately the only possible solution in a nutshell is to exclude the traffic from those devices from decryption.
There countless posible ways to do it, but it up to you and your environment to choose the best one.
"Is there a setting in the Palo that says " If client does NOT trust forward-trust cert, then Do Not Decrypt?"" - even if there is such configuration, it will make the whole decryption pointless. Nothing can stop your users to delete your internal CA and bypass the decryption. It doesn't make lot of sense to have such configuration.
