Which configuration step is required when implementing a new self-signed root certificate authority (CA) certificate for SSL decryption on a Palo…

When a Palo Alto Networks firewall performs SSL Forward Proxy decryption, it acts as a man-in-the-middle, decrypting traffic, inspecting it, and then re-encrypting it with a new certificate. This new certificate is signed by a Certificate Authority (CA) certificate residing on the firewall. For client browsers to accept this re-encrypted traffic without generating security warnings, they must trust this firewall CA. Therefore, a mandatory implementation step is to export the public key of the firewall's CA certificate (in this case, the self-signed root CA) and import it into the trusted root certificate store of all client devices that will have their traffic decrypted.

B. Certificates are used for identity and encryption, not for network routing decisions. The concept of a "default routing certificate" is not applicable in this context.

C. Issuing certificates with indefinite validity is a significant security risk and violates certificate lifecycle best practices. All certificates should have a defined expiration date.

D. This is an operational deployment strategy to manage user impact, not a required technical configuration step for implementing the certificate itself. Decryption can be enabled once the CA is trusted by clients.

1. Palo Alto Networks TechDocs

"Configure SSL Forward Proxy": "To ensure that browsers trust the firewall as a CA

you must install the certificate that the firewall uses to sign decrypted traffic in the trust store of each client browser. You can deploy the certificate to browsers using Group Policy Object (GPO)

Apple profiles

or GlobalProtect." This statement directly confirms that distributing the CA certificate to client trust stores is a required step. (Reference: PAN-OS® Administrator's Guide > Objects > Decryption > Configure SSL Forward Proxy)

2. Palo Alto Networks TechDocs

"Keys and Certificates for Decryption Policies": "For SSL Forward Proxy decryption

the firewall uses a forward trust certificate to sign the server certificates that it presents to clients... For clients to trust the certificates that the firewall generates

you must install the forward trust certificate in the client’s browser as a trusted root CA." This reinforces the necessity of installing the CA certificate on client devices. (Reference: PAN-OS® Administrator's Guide > Objects > Decryption > Keys and Certificates for Decryption Policies)

3. Palo Alto Networks TechDocs

"Generate a Self-Signed Root CA Certificate": This document outlines the process of creating the self-signed certificate on the firewall and explicitly notes its purpose for features like SSL Forward Proxy

which presupposes its distribution to clients for trust to be established. (Reference: PAN-OS® Administrator's Guide > Device > Certificate Management > Generate a Self-Signed Root CA Certificate)