Palo Alto Networks NGFW-Engineer Exam - Topic 1 Question 29 Discussion

In a Palo Alto Networks SSL Forward Proxy deployment, the Decryption Profile is the primary policy component used to control how the firewall handles various technical aspects of the decryption process. While the SSL Forward Proxy itself uses a Forward Trust Certificate to resign certificates for the client, the firewall must first perform its own due diligence on the server-side certificate received from the external web server.

The Decryption Profile allows the administrator to define granular security checks for the session. Specifically, within the SSL Decryption Settings tab of the profile, there are options for 'Certificate Revocation Checking.' Here, the engineer can enable and define how the firewall performs Online Certificate Status Protocol (OCSP) and Certificate Revocation List (CRL) checks. These mechanisms are used to verify that the external server's certificate has not been revoked by its issuing CA before the firewall proceeds with the decryption and re-signing process.

Failure to configure these settings within the Decryption Profile would mean the firewall might trust and proxy a connection to an external site that has a technically valid but revoked certificate, creating a significant security hole. Unlike an SSL/TLS Service Profile (which is used for traffic terminating at the firewall) or the Forward Trust Certificate (used for the client-side trust), the Decryption Profile specifically dictates the validation behavior for outgoing proxied sessions.