Troubleshoot UNKNOWN or BAD certificates or CERTIFICATE authorities
Enable logging for TLS/SSL decryption rules to monitor connection events and identify CERTIFICATE-related issues. This helps you diagnose problems with CERTIFICATE authorities, BAD certificates, or UNKNOWN certificates in your TLS/SSL connections.
You can view connection events to determine whether or not the devices are experiencing UNKNOWN CERTIFICATE authorities, BAD certificates, or UNKNOWN certificates. This procedure can also be used if a TLS/SSL CERTIFICATE has been pinned. You must add at least the SSL Flow Flags and SSL Flow Messages columns to the table view of connection events.
Before you begin
-
Set up a decryption rule.
-
Enable logging for your decryption rules as discussed in the section on logging decryptable connections in decryption rules in the Secure Firewall Management Center and Threat Defense Management Network Administration guide.
Follow these steps to troubleshoot UNKNOWN or BAD certificates or CERTIFICATE authorities:
Procedure
Step 1 | Click . | ||||||||
Step 2 | Click Table View of Connection Events. | ||||||||
Step 3 | Click x on any column in the connection events table to add additional columns for at least SSL Flow Flags and SSL Flow Messages.
The following example shows adding the SSL Actual Action, SSL Flow Error, SSL Flow Flags, SSL Flow Messages, SSL Policy, and SSL Rule columns to the table of connection events. 
The columns are added in the order discussed in the section on connection and security intelligence event fields in the Secure Firewall Management Center and Threat Defense Management Network Administration guide. | ||||||||
Step 4 | Click Apply. | ||||||||
Step 5 | Review the SSL flow flags to determine if a CERTIFICATE or CERTIFICATE authority is BAD or missing.
|
