Configure SSL Inbound Inspection

1. Verify that the appropriate interfaces are configured as either virtual wire, Layer 2, or Layer 3 interfaces.

   You can't use a tap mode interface for SSL Inbound Inspection.

   To view the configured interfaces, select NetworkInterfacesEthernet. You can select an interface to modify its configuration, including the interface type.
2. Verify that the targeted server certificate has been installed on the firewall.

   To view installed certificates, log in to the firewall and select DeviceCertificate ManagementCertificatesDevice Certificates.

   The TLS versions that your web server supports determine how you should install the server certificate and key on the firewall. We recommend uploading a certificate chain (a single file) to the firewall if your end-entity (leaf) certificate is signed by one or more intermediate certificates and your web server supports TLS 1.2 and either RSA or PFS key exchange algorithms. Uploading the chain avoids client-side server certificate authentication issues.

   Arrange the certificates in the file as follows:

   1. End-entity (leaf) certificate
   2. Intermediate certificates (in issuing order)
   3. (Optional) Root certificate

   You can upload the server certificate and private key alone to the firewall when the leaf certificate is signed by intermediate certificates if your web server supports TLS 1.3 connections and the certificate chain is installed on the server. SSL Inbound Inspection discusses each case in more detail.

   To import the targeted server certificate onto the firewall:

   1. Select DeviceCertificate ManagementDevice Certificates, and then Import a certificate.
   2. Enter a descriptive Certificate Name.
   3. Browse for and select the targeted server Certificate File.
   4. Click OK to save your changes.
3. Create a Decryption policy rule to define the traffic that the firewall decrypts.

   1. Select PoliciesDecryption, and then Add a new rule or modify an existing rule.
   2. Select Options and configure the following:

      • For Action, select Decrypt.
      • For Type, select SSL Inbound Inspection.
      • Add up to twelve Certificates for the internal server you want to protect.
        Support for multiple certificates enables you to update server certificates without creating downtime and to create a policy rule for an internal server that hosts various domains, where each domain has its own certificate.
        To update a certificate for a protected internal server without incurring downtime, follow these steps:

        1. Renew or obtain a new server certificate before the current one expires or otherwise becomes invalid.
        2. Import the new certificate and private key onto your firewall.
        3. Add the new certificate to your SSL Inbound Inspection policy rule.
           This must be done while a different certificate is active on the web server, so that a valid certificate in the policy rule always matches the certificate presented by the server.
        4. Install the new certificate on your web server, and then verify that it was properly installed.

        Installation of the new certificate does not impact existing connections. The firewall verifies that the certificate in the Server Hello message matches the certificate in your decryption policy rule. If there isn't a match, the session ends, and the corresponding Decryption log entry reports the session-end reason as a certificate mismatch between the firewall and server. To view the server certificates used in all inbound inspection sessions, select Log Successful SSL Handshake under Log Settings (PoliciesDecryptionOptions).

        (Panorama ^™) Support for multiple certificates in SSL Inbound Inspection policy rules isn't available on PAN-OS versions earlier than PAN-OS 10.2. If you push an SSL Inbound Inspection policy rule with multiple certificates from a Panorama management server running PAN-OS 11.1 to a firewall running older software, the policy rule on the managed firewall inherits only the first certificate from the alphabetically sorted list of certificates.

        Before pushing your decryption policy rule from Panorama, we recommend setting up different templates or device groups for firewalls running PAN-OS 10.1 and earlier to ensure you push the correct policy rule and certificate to the appropriate firewalls.
      • (Best Practice) Select or create a that blocks insecure protocol versions and cipher suites.
        To create a best practice decryption profile for SSL Inbound Inspection, configure the options described in SSL Inbound Inspection Decryption Profile.
        Create separate profiles for servers with different security capabilities. For example, if a group of servers supports only RSA, in the SSL Protocol Settings of the Decryption profile, select only RSA for the key exchange algorithm. Likewise, for servers that support PFS, set the SSL Protocol Setting to only support PFS.

        Configure the SSL Protocol Settings for the highest level of security that the server supports, but check performance to ensure that the firewall can handle the higher processing load that higher security protocols and algorithms require.
   3. Click OK to save your changes.
4. (Advanced WildFire subscriptions only) Forward decrypted SSL traffic to the Advanced WildFire cloud for analysis.

   This option is an Advanced WildFire best practice.
5. Commit your changes.
6. (PAN-OS 11.2 & later, HSM deployments only) Activate TLSv1.3 support for SSL Inbound Inspection with an HSM.

   Use the set ssl inbound-inspection tls1.3-with-hsm enable yes CLI command.
7. Choose your next step:

   • Enable users to opt out of SSL decryption.
   • Configure decryption exclusions for traffic that you don’t want to decrypt.