Palo Alto Networks: SSL Decryption Exclusion

Some websites might not like SSL decryption or due to certificate pinning, There are several ways of doing getting past that, but I’ll be covering the best solution. First solution is to use an URL filtering profile, which is tacky at best. But there’s a better solution and easier.

If you head down to Device > Certificate management > SSL Decryption Exclusion, you can add two entries with one of them being a wildcard. Make sure to select the box “Exclude” and “Shared”.

And a wildcard, just in case:

In the URL filtering logs, select the column “URL” and “Decrypted”. And as we can see *genk.be isn’t decrypted anymore.

Leave a Reply

Your email address will not be published. Required fields are marked *