A company requires the firewall to block expired certificates issued by internet-hosted websites. The company plans to implement decryption in the future, but it does not perform SSL Forward Proxy…

Question

Options

• ABy having a Certificate profile that contains the website's Root CA assigned to the respective
• BBy using SSL Forward Proxy to decrypt SSL and TLS handshake communication and the
• CBy using SSL Forward Proxy to decrypt SSL and TLS handshake communication in order to
• DBy having a Decryption profile that blocks sessions with expired certificates in the No Decryption

• A
  4% (1)
• B
  8% (2)
• C
  4% (1)
• D
  83% (20)

Explanation

Even without SSL Forward Proxy decryption, the firewall can still inspect the SSL/TLS handshake, which is transmitted in plaintext before the encrypted tunnel is established. The handshake contains the server's certificate, including its validity dates, issuing CA, and revocation status. A Decryption profile attached to a 'No Decryption' policy rule can be configured to block sessions with expired certificates, untrusted issuers, or unknown revocation status based solely on this handshake inspection - no payload decryption is required. This is the key purpose of the No Decryption mode in a Decryption profile.

No community discussion yet for this question.