Strata Cloud Manager

1. Select ManageConfigurationNGFW and Prisma Access.
2. From the Configuration Scope dropdown, select the folder or NGFW for which you want to configure outbound decryption.
3. Select Device ManagementEgress Decryption.
4. For Untrust Certificate, select a Cloud Certificate from the dropdown.

   Add a certificate if you have not done so already.
5. For Trust Certificate, select a Cloud Certificate from the dropdown.

   The certificate and private key are stored in the Azure Key Vault, and the workload uses this information to decrypt the traffic.

   The certificate must be a CA certificate. Set the CA value in the Basic Constraints to TRUE.

   PKCS8 is the supported certificate format.

   Trust certificates can't be self-signed, but the untrust certificate can be self-signed or CA-signed.
6. Click Save.
7. Verify that the managed identity assigned to the NGFW has the Key Vault Certificates Officer and Key Vault Secrets User roles configured in Azure Key VaultAccess Policies.