>
    Configure Server Certificate Verification for Undecrypted Traffic
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. Decryption
    4. Configure Server Certificate Verification for Undecrypted Traffic
    Download PDF

    Configure Server Certificate Verification for Undecrypted Traffic

    Table of Contents

    Configure Server Certificate Verification for Undecrypted Traffic

    Even though the traffic is encrypted, you can protect your network against sessions with expired certificates and untrusted issuers for traffic you choose not to decrypt for legal, business, or privacy reasons.
    You create no-decryption policies for traffic that you
    choose
     not to decrypt because the traffic is personal, sensitive, or subject to local laws and regulations. For example, you may choose not to decrypt the traffic of certain executives or traffic between finance users and finance servers that contain personal information. (Don’t exclude traffic that you can’t decrypt because a site breaks decryption for technical reasons such as a pinned certificate or mutual authentication by policy. Instead, add the hostname to the Decryption Exclusion List.)
    However, just because you don’t decrypt the traffic doesn’t mean you should let any and all undecrypted traffic on your network. It is a best practice to apply a No Decryption profile to undecrypted traffic to block sessions with expired certificates and untrusted issuers.
    1. Create a Decryption Policy Rule to identify the undecrypted traffic and Create a Decryption Profile to block bad sessions.
      1. Select
        Policies
        Decryption
         and Add or modify an existing rule to identify the undecrypted traffic.
      2. Select
        Options
         and:
        • Set the rule
          Action
           to
          No Decrypt
           so that the firewall doesn’t decrypt traffic that matches the rule.
        • Ignore the rule
          Type
           because the traffic is not decrypted.
        • (
          Optional but a best practice
          ) Configure or select an existing Decryption profile for undecrypted traffic to block sessions with expired certificates and untrusted certificate issuers.
          Do not attach a No Decryption profile to Decryption policies for TLSv1.3 traffic that you don’t decrypt because the firewall can’t read the encrypted certificate information so it can’t perform certificate checks. However, you should still create a Decryption policy for TLSv1.3 traffic that you don’t decrypt because undecrypted traffic isn’t logged unless a Decryption policy controls that traffic.
    2. Commit
       the configuration.
    3. Choose your next step:

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.