About gwesson

You might have an exception for Threat ID 40006 in one or more of your security profiles. A simple way to check your whole config for that can be done in CLI: > show config running hit / (forward slash) to begin searching, and enter:  40006 You'll have to scroll up (using the "J" key, may also work with arrow keys) to the top of that entry to find the profile name, and there may be multiple profiles that have it. ... View more

There are some debugs, but they can be dangerous to turn on because of the volume of logs it generates (flow basic + proxy basic). I highly recommend opening a case with support to go through the policy and config to see if they can help with a review of your system before diving in to the debugs. ... View more

I apologize, I completely missed that in your original post.    No, if you see policy deny, then that session was definitely denied. What is the user experience when this happens? Can the site be browsed as normal if you proceed past the certificate warning? If you can browse normally then the denied session is likely not all that important.   I hate leaving something like that unknown, but it all depends on how much time you want to put into research if the user experience is fine. ... View more

Is it actually being blocked and you're getting a firewall block page? Or are you saying that your browser shows the certificate as expired even though the firewall is decrypting it?   If it's the latter, that is expected. The firewall copies values from the server's certificate to create the decryption certificate. It takes the Subject and the Validity Period values, so if the server's cert or common name/sni are "bad" then the decrypted version will be "bad" as well. ... View more