Which configuration step is required when implementing a new self-signed root certificate authority (CA) certificate for SSL decryption on a Palo Alto Networks firewall?

When implementing SSL Forward Proxy decryption on a Palo Alto Networks firewall, the firewall acts as a man-in-the-middle. It intercepts client SSL requests and dynamically generates a certificate for the destination server, signing it with its configured Forward Trust CA certificate. If this CA is a newly generated self-signed certificate (or an untrusted subordinate CA), client operating systems and browsers will not recognize the issuer, resulting in severe security warnings and blocked connections. To ensure a seamless and secure user experience, administrators must export this CA certificate from the firewall and deploy it into the Trusted Root Certification Authorities store of all client devices, typically using Group Policy (GPO) or Mobile Device Management (MDM) solutions.

Option B: PAN-OS does not use "routing certificates." Certificates are applied to SSL/TLS Service Profiles or Decryption profiles, not network routing tables.
Option C: Certificates cannot have indefinite validity. PAN-OS requires a specific expiration date, and indefinite validity violates fundamental Public Key Infrastructure (PKI) security best practices.
Option D: Disabling decryption rules is completely unnecessary. The new certificate can be assigned as the Forward Trust CA seamlessly without disrupting or disabling the existing decryption policy rulebase.

1. Palo Alto Networks. (2023). PAN-OS 11.0 Administrator's Guide. Section: Decryption > Configure SSL Forward Proxy. (Specifically notes: "If you use a self-signed CA certificate generated on the firewall, you must export the certificate from the firewall and import it into the trusted root CA store of each client machine.")

2. Palo Alto Networks. (2023). PAN-OS 11.0 Administrator's Guide. Section: Certificate Management > Keys and Certificates. (Details the requirements for certificate validity periods and trust store deployment).