Troubleshoot Unknown or Bad Certificates or Certificate Authorities
You can view connection events to determine whether or not the devices are experiencing unknown certificate authorities, bad certificates, or unknown certificates. This procedure can also be used if a TLS/SSL certificate has been pinned. You must add at least the SSL Flow Flags and SSL Flow Messages columns to the table view of connection events.
Before you begin
-
Set up a decryption rule.
-
Enable logging for your decryption rules as discussed in the section on logging decryptable connections in decryption rules in the Secure Firewall Management Center and Threat Defense Management Network Administration guide.
Procedure
Step 1 | Click . | ||||||||
Step 2 | Click Table View of Connection Events. | ||||||||
Step 3 | Click x on any column in the connection events table to add additional columns for at least SSL Flow Flags and SSL Flow Messages.
The following example shows adding the SSL Actual Action, SSL Flow Error, SSL Flow Flags, SSL Flow Messages, SSL Policy, and SSL Rule columns to the table of connection events.  The columns are added in the order discussed in the section on connection and security intelligence event fields in the Secure Firewall Management Center and Threat Defense Management Network Administration guide. | ||||||||
Step 4 | Click Apply. | ||||||||
Step 5 | The following table discusses how you can determine if a certificate or certificate authority is bad or missing.
|
