Certificate rule conditions

When you build a certificate-based decryption rule condition, you can upload a server certificate and save it as an external certificate object. The certificate object is reusable and associates a name with a server certificate. Alternately, you can configure certificate conditions with existing external certificate objects and object groups.

You can search the Available Certificates field in the rule condition based for external certificate objects and object groups based on these certificate distinguished name characteristics:

  • Subject or issuer common name (CN), or if the URL is contained in the certificate's Subject Alternative Name (SAN)

    The URL the user enters in the browser matches the Common Name (CN)

  • Subject or issuer organization (O)

  • Subject or issuer organizational unit (OU)

You can choose to match against multiple certificates in a single certificate rule condition. If the certificate used to encrypt the traffic matches any of the uploaded certificates, the encrypted traffic matches the rule.

You can add a maximum of 50 external certificate objects and external certificate object groups to the Selected Certificates in a single certificate condition.

Note these items:

  • You cannot configure a certificate condition if you also select the Decrypt - Known Key action. That action requires you to select a server certificate to decrypt traffic. Therefore, the certificate already matches the traffic.

  • When the system first detects an encrypted session to a new server, it does not have certificate data for ClientHello processing. As a result, the first session may not be decrypted. After the initial session, the managed device caches data from the server Certificate message. For subsequent connections from the same client, the system can match the ClientHello message conclusively to rules with certificate conditions and process the message to maximize decryption potential.