Palo Alto SSL/TLS Decryption Audit

Security profiles can only inspect traffic they can see.

As more application traffic is encrypted, decryption becomes an important part of a Palo Alto firewall security assessment.

The goal is deliberate decryption.

Measure actual decryption coverage

The configuration tells you what is intended.

Logs tell you what is happening.

Where available, use decryption logs, reporting and traffic logs to estimate how much TLS traffic is actually decrypted.

Look particularly at:

• outbound web browsing
• file downloads
• internet-facing services
• sensitive zones
• traffic covered by strong security profiles but not decrypted

Low coverage may mean that expensive security controls are operating with limited visibility.

Review decryption policy

Decryption policy is evaluated top-down, first match.

Review it in much the same way as a security policy.

Ask:

• Is outbound traffic covered by an appropriate decrypt rule?
• Are no-decrypt rules above decrypt rules where required?
• Are broad no-decrypt rules creating unnecessary gaps?
• Are rules shadowing one another?
• Is coverage consistent between sites and firewalls?

Review exclusions

Not all traffic should necessarily be decrypted.

Examples include:

• privacy-sensitive traffic
• certificate-pinned applications
• sites known to break under decryption
• deliberately approved organizational exceptions

Custom exclusions deserve particular attention.

For every custom exclusion ask:

• Why was it added?
• Is the reason documented?
• Is it as narrow as possible?
• Is it still required?

A temporary troubleshooting exception can become a permanent visibility gap if nobody reviews it.

Certificates and keys

Decryption depends on certificates and private keys held by the firewall.

Review:

• forward trust certificate
• forward untrust certificate
• protection of the forward trust CA private key
• master key protection
• inbound inspection keys
• keys belonging to decommissioned systems

The forward trust CA is particularly sensitive because compromise could allow trusted certificates to be created for arbitrary websites.

Governance and privacy

Decryption provides visibility into traffic users may reasonably expect to be private.

The audit should therefore consider whether:

• a documented policy exists
• appropriate legal/privacy stakeholders were involved
• users are informed where appropriate
• access to decrypted data is controlled
• exclusions reflect approved policy

The auditor is not providing legal advice. The objective is to establish that the organization's decisions were deliberate and that the configuration reflects them.