Which action can be taken to immediately remediate the issue of application traffic with a valid use case triggering the decryption log message, "Received fatal alert UnknownCA from client"?

Question

Options

• AEnable certificate revocation checking to deny access to sites with revoked certificates
• BAdd the certificate CN to the SSL Decryption Exclusion List to allow traffic without decryption
• CCheck for expired certificates and take appropriate actions to block or allow access based on
• DContact the site administrator with the expired certificate to request updates or renewal

• A
  14% (4)
• B
  75% (21)
• C
  7% (2)
• D
  4% (1)

Explanation

The error 'Received fatal alert UnknownCA from client' occurs during SSL/TLS inspection when the client does not trust the firewall's CA certificate used for decryption - for example, an application with certificate pinning or a proprietary client that cannot accept a proxy certificate. Since the traffic has a valid use case and re-issuing or installing a certificate on every client is not immediate, the fastest remediation is to add the certificate's Common Name (CN) to the SSL Decryption Exclusion List. This tells the firewall to pass that specific traffic through without attempting to decrypt it, immediately stopping the alert. Option A addresses revoked certificates, which is unrelated. Options C and D involve expired certificates, also unrelated to the UnknownCA alert.

No community discussion yet for this question.