While troubleshooting an SSL Forward Proxy decryption issue, which PAN-OS CLI command would you use to check the details of the end entity certificate that is signed by the Forward Trust Certificate…

Question

Options

• Ashow system setting ssl-decrypt certs
• Bshow system setting ssl-decrypt certificate
• Cdebug dataplane show ssl-decrypt ssl-stats
• Dshow system setting ssl-decrypt certificate-cache

• A
  3% (1)
• B
  87% (33)
• C
  8% (3)
• D
  3% (1)

Explanation

During SSL Forward Proxy troubleshooting, you may need to inspect the end entity (server) certificate that the firewall re-signed using either the Forward Trust or Forward Untrust CA certificate. The command 'show system setting ssl-decrypt certificate' (B) displays the details of the end entity certificate currently being inspected in the decryption pipeline. Option A ('ssl-decrypt certs') does not exist as a valid PAN-OS command. Option C is a debug dataplane command that shows aggregate SSL decryption statistics, not individual certificate details. Option D shows the SSL certificate cache contents, which lists previously seen certificates but does not display the details of the specific end entity cert in the way needed for active troubleshooting.

No community discussion yet for this question.