PAN-OS now supports the decryption of TLSv1.3 sessions in SSL Inbound Inspection mode when the private keys of internal servers are stored on Hardware Security Modules (HSMs). The superior performance and security of TLSv1.3 combined with the protection of HSMs hardens inbound decryption. This feature is only compatible with the Thales Luna Network and Entrust nShield Connect HSMs. To activate this support, use the

set ssl inbound-inspection tls1.3-with-hsm enable yes

CLI command. This feature is disabled by default. You must set up connectivity between a supported HSM and Palo Alto Networks appliances

and

apply a Decryption profile that specifies TLSv1.3 as the minimum or maximum supported TLS version to an SSL Inbound Inspection rule first.