Paloalto Networks Paloalto Certifications and Accreditations PCNSC Question # 6 Topic 1 Discussion

When SSL Forward Proxy decryption is enabled, and clients using Chrome need to see browser warnings for websites with invalid certificates, the following options will satisfy the requirement:

A.Create a Decryption Profile with the Block sessions with expired certificates option enabled: This option ensures that sessions with expired certificates are blocked, which will present a warning to the user.

B.Create a self-signed Forward Untrust enabled certificate: This certificate will be used for websites with invalid or untrusted certificates, prompting the browser to display a warning.

These configurations ensure that users are properly warned when accessing sites with invalid certificates, allowing them to decide whether to proceed.

References:

Palo Alto Networks - SSL Decryption Best Practices: https://docs.paloaltonetworks.com/best-practices

Palo Alto Networks - Configuring SSL Forward Proxy: https://knowledgebase.paloaltonetworks.com