When you troubleshoot an SSL Decryption issue, which PAN-OS CL1 command do you use to check the details of the Forward Trust certificate. Forward Untrust certificate, and SSL Inbound Inspection certificate?

The show system setting ssl-decrypt certificate command is the designated PAN-OS CLI command to view the configured certificates for SSL Decryption. This command displays the specific certificates assigned to the roles of Forward Trust, Forward Untrust, and SSL Inbound Inspection. It is the standard operational command for verifying which certificates are actively configured for these decryption functions, which is a primary step in troubleshooting SSL Decryption issues related to certificate trust.

B: The command syntax is incorrect. The correct keyword is the singular certificate, not the plural certs. C: This is a debug command used for advanced, real-time dataplane troubleshooting, not for viewing the static certificate configuration. D: This command displays the cache of certificates that the firewall has dynamically signed, not the primary configured certificates like Forward Trust.

1. Palo Alto Networks. (2021). PAN-OS® CLI Quick Reference 10.2. Page 121. Retrieved from Palo Alto Networks Technical Documentation. The guide lists show system setting ssl-decrypt certificate with the description "Display SSL Decryption certificate settings."

2. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide 10.2. In the "Troubleshoot SSL Forward Proxy" section, initial verification steps involve checking the configured certificates. The show system setting ssl-decrypt certificate command directly provides this required information from the CLI.

3. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide 10.2. In the "Configure SSL Forward Proxy" section, after configuring the Forward Trust and Forward Untrust certificates, this show command is the CLI method to verify the configuration has been applied correctly.