Get Started with SSL Decryption

Get Started with SSL Decryption

1. Configure a “blanket” No Decrypt decryption policy rule with lenient settings, including:

   This will help you better understand the websites and apps your users access.

   1. Select Any for the following Source, Destination, and Service/URL Category settings: Source User, Source Device, Destination Address, Destination Device, Service, and URL Category.
   2. Select Options, and then for Action, select No Decrypt.
   3. Under Log Settings, select Log Successful SSL Handshake to view cryptography information in the decryption logs.
   4. Attach a decryption profile without any Server Certificate Verification settings selected to the no-decrypt decryption policy rule.
   5. Commit your changes.
2. Inspect your decryption logs.

   Search the decryption logs for the following:

   • Usage of vulnerable cryptographic protocols (for example, TLSv1.1 or earlier).
     To secure your network, set your decryption profile to block vulnerable ciphers.
   • Expired or invalid certificate usage.
   • Any errors or unexpected issues.

   Prioritize the following log fields in your search: Encryption Algorithm, TLS Version, Key Exchange, Error, Server Name Indication, Certificate End Date.

   Refer to the Troubleshoot Decryption chapter for details on how to search through decryption logs, identify vulnerable ciphers and invalid certificates, as well as troubleshoot decryption errors. For a list of errors you might encounter in your logs and possible remediation, see Decryption Log Errors and Error Indexes.
3. Load or generate a CA certificate on the NGFW, Prisma Access, or management interface.

   Limit the use of self-signed certificates where possible; instead, use preexisting certificates that client browsers already trust.
4. Identify a small group of users (5-10) in your network to test and validate a decryption proof of concept.

   Ideal users are familiar with the technology and are willing and able to provide feedback, such as a member of the IT organization.
5. Create your proof of concept.

   1. Create decryption profiles using SSL decryption best practices.

      • Block insecure sessions–sessions with expired certificates, untrusted issuers, unsupported versions, and unsupported cipher suites.
      • Block sessions with client authentication unless an important application requires it, in which case you should create a separate decryption profile for those applications.
      • Use the strongest ciphers that you can. For SSL Forward Proxy, set the minimum protocol version to TLSv1.2 and the maximum version to Max to block weak protocols. For SSL Inbound Inspection, create separate profiles that match the ciphers that your servers support.
   2. Create a new decryption policy rule.

      • For Source User, Add the group of users who are part of the proof of concept.
      • Block access to a small subset of URLs or URL categories, such as categories that Palo Alto Networks has identified as risky. Decrypting a small subset makes the rule easier to phase in.
      • Create specific decryption policy rules and profiles for applications that use less secure ciphers and protocols (for example, TLSv1.1), so that the security of other application traffic isn't affected.
6. Launch your proof of concept (PoC).

   Continuously monitor feedback and issues from your test users. For your first set of 5-10 users, we suggest running the proof of concept for at least two weeks to ensure any issues from normal network traffic arise.
7. Expand your proof of concept to a larger group (100+ users).

   Make sure it is a diverse group; the network traffic of these users should be representative of that of the organization at large.

   We suggest running this for 2-4 weeks to surface any issues. You may need to account for applications used for recurring periodical events (for example, quarterly meetings).
8. Refine your decryption policy rules as necessary.