The administrator for a small company has recently enabled decryption on their Palo Alto Networks firewall using a self-signed root certificate. They have also created a Forward Trust and Forward…

Question

Options

• ADecryption will function and there will be no effect to end users
• BDecryption will not function because self-signed root certificates are not supported
• CDecryption will not function until the certificate is installed on client systems
• DDecryption will function but users will see certificate warnings for each SSL site they visit

• A
  9% (2)
• B
  4% (1)
• D
  87% (20)

Explanation

SSL Forward Proxy decryption will function even if the self-signed root CA certificate has not been deployed to client systems. The firewall intercepts SSL sessions, decrypts them for inspection, and re-signs them using the Forward Trust or Forward Untrust certificate (which chain up to the self-signed root CA). The traffic is re-encrypted and forwarded. However, because the client browsers do not have the self-signed root CA in their trusted certificate store, they cannot validate the re-signed certificates - resulting in browser certificate warnings (e.g., 'Your connection is not private') for every HTTPS site visited. Decryption itself is operational, but the user experience is degraded until the root CA is distributed and trusted by client systems.

No community discussion yet for this question.