About pk11

This new feature is designed to help whitelist sites that will normally NOT WORK with decryption due to technical reasons - such as pinned certs, client side authentication with certs, etc.     As customers are also using their Decryption Policies and Decryption Profiles to perform decryption classification (what to decrypt), how to handle certificate errors, which cipher suites to use, etc, this feature isn't primarily used to police what should and shouldn't be decrypted.  The decryption policy/profiles and URL filtering categories are all still used to perform the "what should be decrypted" policing.     The logic behind this feature is to not break the user experience if the other policies are ALLOWING the user to go to the site.  If they're allowed, this feature simply allows the user to go to the site without having it break as the firewall will not be able to decrypt the session due the certificate issues mentioned.   Of course customers can still disable these sites and have them break as before.  But many of our customers wanted the default to ALLOW the user to access the site by whitelisting as the site is a trusted and permitted site.     Thanks ... View more