Which configuration step is required when implementing a new self-signed root certificate authority (CA) certificate for SSL decryption on a Palo Alto Networks firewall?

Question

Options

• AImport the new subordinate CA certificate into the trust stores of all client devices.
• BSet the subordinate CA certificate as the default routing certificate for all network traffic.
• CConfigure the subordinate CA to issue certificates with indefinite validity periods.
• DDisable all existing SSL decryption rules until the new certificate is fully propagated.

• A
  94% (31)
• B
  3% (1)
• D
  3% (1)

Explanation

When a Palo Alto Networks firewall performs SSL Forward Proxy decryption, it dynamically generates and signs certificates on behalf of the sites being visited, using its own CA certificate. Because these dynamically generated certificates are signed by the firewall's (self-signed) CA - which is not trusted by default - client browsers and applications will display certificate errors unless they trust that CA. The required step is to import the firewall's CA certificate into the trust store of every client device (via Group Policy for domain machines, MDM for mobile devices, etc.). Without this, decryption causes widespread certificate warnings and user disruption. Answers B, C, and D describe configurations that are either non-existent features or counterproductive to a functioning SSL decryption deployment.

No community discussion yet for this question.