Palo Alto SSL Decrypt Breaks One SaaS App: CLI to Find the Decrypt Policy

Palo Alto · Techclick CLI troubleshooting lab

Salesforce loads. A smaller SaaS app shows certificate warning only for users behind the firewall.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Palo Alto for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Identify the session, confirm it is decrypted, then exclude that app or that certificate pin from ssl-inbound/forward-proxy. Do not turn off decryption globally.

Why this ticket shows up

Forward-proxy decryption replaces the server certificate. Apps that pin certificates or use mutual TLS will fail even when the rest of the internet looks fine.

Symptoms operators actually see

• Browser NET::ERR_CERT_AUTHORITY_INVALID on one FQDN

• Works on guest Wi-Fi

• Decryption log shows Session decrypted

• Mobile app fails, browser sometimes works

CLI first — copy this block

Run these on the Palo Alto device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show session all filter destination-port 443 application ssl
show log decryption query equal "( url contains example-saas.com )"
show running security-policy | match decrypt
debug dataplane packet-diag set log feature ssl all
show system setting ssl-decrypt certificate

How to read that output

If the decryption log says decrypted and the client error is a name or pin mismatch, the decrypt policy hit a cert-pinning app. Exclusion belongs in the decryption policy, not in the security policy.

Triage order

1. Get the exact FQDN from the user screenshot.

2. Find the session and the matching decryption log.

3. Confirm the Forward Trust / Untrust certificate is the one the client should trust.

4. Add a no-decrypt rule for that FQDN or category, above the decrypt-all rule.

5. Retest only that app; leave decryption on for the rest of the estate.

Classic traps

What you see	Real cause	Fix
Turn off decrypt everywhere	One app pins certs	No-decrypt that FQDN only
Install any root	Phone profile missing Forward Trust	Push the same CA to mobile
Security rule deny	It is a decrypt failure	Read decryption log, not traffic log

Proof the ticket is closed

• SaaS app opens without warning

• Decryption log shows no-decrypt for that FQDN

• Other HTTPS sites still decrypt

Say this in an interview

I treat certificate pinning as a decryption exception, not as a reason to disable SSL decrypt.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/