Configure SSL Inbound Inspection (Strata Cloud Manager)

1. Verify that the appropriate interfaces are configured as either virtual wire, Layer 2, or Layer 3 interfaces.

   You can't use a tap mode interface for SSL Inbound Inspection.

   To view the configured interfaces, select ConfigurationNGFW and Prisma AccessDevice SettingsInterfaces. You can select an interface to modify its configuration, including the interface type.
2. Verify installation of the certificate for the destination server.

   To view installed certificates, log in to Strata Cloud Manager, and then select ConfigurationNGFW and Prisma AccessObjectsCertificate Management.

   The TLS versions that your web server supports determine how you should install the server certificate and key. We recommend uploading a certificate chain (a single file) if your end-entity (leaf) certificate is signed by one or more intermediate certificates and your web server supports TLSv1.2 and either RSA or PFS key exchange algorithms. Uploading the chain avoids client-side server certificate authentication issues.

   Arrange the certificates in the file as follows:

   1. End-entity (leaf) certificate
   2. Intermediate certificates (in issuing order)
   3. (Optional) Root certificate

   You can upload the server certificate and private key alone to Strata Cloud Manager when the leaf certificate is signed by intermediate certificates, if your web server supports TLSv1.3 connections and the certificate chain has been installed on the server. SSL Inbound Inspection discusses each case in detail.

   To import the server certificate onto Strata Cloud Manager:

   1. Select ConfigurationNGFW and Prisma AccessObjectsCertificate Management, and then Import a Custom Certificate.
   2. Enter a descriptive Certificate Name.
   3. Browse for and select the Certificate File.
   4. Save the certificate.
3. Create a decryption policy rule to define the traffic that the NGFW decrypts.

   1. Select ConfigurationNGFW and Prisma AccessSecurity ServicesDecryption, and then Add Rule or select an existing rule.
   2. Under the Action and Advanced Inspection section, configure the following settings:

      • For Action, select Decrypt.
      • For Type, select SSL Inbound Inspection.
      • Add up to 12 Certificates for the internal server you want to protect.
        To update the certificate for a protected internal server without incurring downtime, follow these steps:

        1. Renew or obtain a new server certificate before the current one expires or otherwise becomes invalid.
        2. Import the new certificate and private key onto your NGFW.
        3. Add the new certificate to your SSL Inbound Inspection policy rule.
           This must be done while a different certificate is active on the web server, so that a valid certificate in the policy rule always matches the certificate presented by the server.
        4. Install the new certificate on your web server, and then verify that it was properly installed.

        Installation of the new certificate doesn't impact existing connections. The NGFW verifies that the certificate in the Server Hello message matches the certificate in your decryption policy rule. If there isn't a match, the session ends, and the corresponding decryption log entry reports the session-end reason as a certificate mismatch between the firewall and server. To view the server certificates used in all inbound inspection sessions, select the Log Successful TLS handshakes and Log Unsuccessful TLS handshakes options under the Log Settings section of a decryption policy rule.
      • (Best Practice) Select or create a that blocks insecure protocol versions and cipher suites.
        To create a best practice decryption profile for SSL Inbound Inspection, configure the options described in SSL Inbound Inspection Decryption Profile.
        Create separate profiles for servers with different security capabilities. For example, if a group of servers supports only RSA, in the SSL Protocol Settings of the decryption profile, select only RSA for the key exchange algorithm. Likewise, for servers that support only PFS, set the SSL Protocol Settings to only support PFS.

        Configure the SSL Protocol Settings for the highest level of security that the server supports, but check performance to ensure that the NGFW can handle the higher processing load that higher security protocols and algorithms require.
   3. Save your changes.
4. (Advanced WildFire subscriptions only) Forward decrypted SSL traffic to the Advanced WildFire cloud for analysis.
5. (PAN-OS 11.2 & later, HSM deployments only) Activate TLSv1.3 support for SSL Inbound Inspection with an HSM.

   Use the set ssl inbound-inspection tls1.3-with-hsm enable yes CLI command.
6. Commit your changes.

   Select Push ConfigPush.
7. Choose your next step:

   • Enable users to opt out of SSL decryption.
   • Configure decryption exclusions for traffic that you don’t want to decrypt.