Hello friends, welcome to Day 30 of my PCNSA series. In this video I show you the complete, practical way to configure SSL Decryption in Palo Alto—step by step in a simple lab. I start from the basics you actually need in real troubleshooting: how to generate a self-signed certificate on the firewall, what to put in CN (I used my inside interface IP because I don’t have DNS in the lab), and why we use it as a Forward Trust certificate for forward proxy decryption. After that, I create the SSL/TLS Service (SSL Decryption) profile and I explain what those checks mean in real life—certificate expired, untrusted issuer, unsupported cipher/mode, and what to do when the firewall is too busy (fail-open vs fail-close behavior). Then I build the decryption policy (inside to outside), along with the required security policy and NAT, and we commit. Finally, I verify the decryption properly: first you’ll see the browser privacy error because the root CA isn’t installed on the PC. I download/export the cert, install it in Trusted Root (local machine and current user), and then you can see Google/Yahoo certificates being issued by the Palo Alto. In Monitor logs, I enable the “decrypted” column to confirm HTTPS sessions are getting decrypted. I also show the SSL Decryption Exclusion list and why, as per cyber rules, some private apps/sites are excluded by default.