Inspect SSL/TLS Handshakes (

PAN-OS

&

Panorama

)

Select
Device > Licenses
to confirm that you have an active Advanced URL Filtering or legacy URL Filtering license.
Verify that you decrypt SSL/TLS traffic through either SSL Forward Proxy or SSL Inbound Inspection.
Enable inspection of SSL/TLS handshakes by CTD. By default, the option is disabled.

Select
Device
Setup
Session
Decryption Settings
SSL Decryption Settings
.
Select
Send handshake messages to CTD for inspection
.
Alternatively, you can use the
set deviceconfig setting ssl-decrypt scan-handshake
<yes|no>
CLI command.
Click
OK
.
Commit
your configuration changes.