Incoming traffic decryption actions

Both the Decrypt - Replace Cert and Decrypt - Known Key decryption actions enable you to decrypt incoming traffic to a server that you want to protect from malicious attacks.

Decryption action comparison

The Decrypt - Replace Cert decryption action is provided as an alternative to Decrypt - Known Key for these reasons:

Certificates can expire or need to be replaced anytime.

If you choose the Decrypt - Known Key action, decryption can stop and the rule can stop functioning when a certificate is replaced for any reason.
With Decrypt - Replace Cert, the connection matches and traffic is decrypted. Deploying the certificate on the device hours or days later is not an issue.
Decrypt - Replace Cert gives you the flexibility to have separate internal and external facing certificates. For example, you could use payroll.example.local as an internal server hostname, but use payroll.example.com as an externally-facing hostname. You can also use an Enterprise PKI certificate for an internal server but use DigiCert or some other public provider for my external certificate.

The figure shows the difference between Decrypt - Replace Cert and Decrypt - Known Key decryption actions.

The figure illustrates the differences between the Decrypt - Replace Cert and Decrypt - Known Key decryption actions, highlighting the use of separate internal and external certificates for server hostnames.

This table provides more information.


	Known Key	Replace Cert
Must match certificate installed on internal server or resource	Yes	No
The device must trust the internal certificate (that is, it must be chained to Trusted CAs list in the decryption policy)	No	No
Certificate hostnames can be different between device-installed certificate and that on the internal server	No, certificates must be identical. (Although multiple SANs can be on the certificates to accommodate different internal and external host names.)	Yes, certificates and certificate host names can be completely different, as long as the internal certificate is trusted by the user's device.
Works if the internal server certificate is expired	Yes – As long as it matches the certificate installed on the device.	No – an expired certificate causes broken trust, and therefore a mismatch.