Which two prerequisites must be evaluated when decrypting internet-bound traffic? (Choose two.)

When planning to implement SSL Forward Proxy decryption, two critical factors must be evaluated to prevent application breakage and ensure security. Certificate pinning is a mechanism where an application is coded to only trust a specific server certificate. A firewall performing man-in-the-middle decryption will present its own certificate, which the application will reject, causing the connection to fail. Therefore, pinned applications must be identified and excluded. Secondly, the firewall must validate the certificate from the destination server. If the server provides an incomplete certificate chain, the firewall may be unable to establish a chain of trust to a known root CA, leading it to block the session based on policy. This behavior must be evaluated and configured.

A. RADIUS profile: A RADIUS profile is used for network access authentication (User-ID) and is not a direct technical prerequisite or impediment for the TLS decryption process.

D. SAML certificate: A SAML certificate is used to sign assertions for identity federation (SSO) and is not a core component that is evaluated for the TLS handshake decryption mechanism.

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide 10.2.

On Certificate Pinning: In the section "Prepare to Deploy Decryption

" it states: "Some applications

particularly mobile and cloud-based applications

use a security mechanism called certificate pinning... Because the firewall decrypts and re-encrypts traffic with its own certificate

applications that use certificate pinning do not work with decryption and you must exclude them from decryption." (Chapter: Decryption > Prepare to Deploy Decryption > Identify Applications To Exclude From Decryption).

On Incomplete Certificate Chains (Untrusted Issuers): The Decryption Profile settings allow administrators to control how the firewall handles certificate validation errors. The "SSL Protocol Settings" within a Decryption Profile include a "Block sessions with untrusted issuers" option. An incomplete chain can lead to an untrusted issuer status

making its evaluation a prerequisite. (Chapter: Objects > Decryption > Decryption Profile).

2. Palo Alto Networks. (2023). Best Practices for SSL/TLS Decryption.

This technical documentation emphasizes identifying applications that will break decryption as a key step. It explicitly calls out "Applications that use certificate pinning" as a primary reason for failure

requiring exclusion. (Section: Phase 1: Discover and Plan).

The document also discusses handling certificate validation issues

stating the need to configure how the firewall handles servers with untrusted certificates

which can result from incomplete chains. (Section: Phase 2: Configure and Deploy).