Hello, I don't trust them but : If I trust their CA, they could sign anything that my user would think is leggit website. And I am 100% sure that they don't take any special measures to protect their CAs . I still want websites to remain untrusted for browser, which is not possible if PA trusts their CA. "Otherwise you can add excludes to a "whitelist" in the PA (listed at List of Applications Excluded from SSL Decryption )" <-- doing such thing means that hackers will get the habbit to use websites that are like site1.gov.co.uk with selfsigned certicates because they know they aren't inspected : applications ignored by SSL Decryption in this case aren't checked against known CAs Usually , tools provided by these organization are checking that the certificate of website/webapp is signed by their internal CA. Also, these tools are often using Client certificates , which makes Decryption impossible. For all these reasons, the only viable possibility is to allow to ignore SSL Decryption when cert is signed by a list third party CA that would be fed by customer. Decryption Policy panel and stack needs a real big revamp to be usable (in addtion of TLS proper implementation)
... View more
