A retail chain must inspect TLS sessions to its payment CDN with intrusion rules, but partner banking apps use certificate pinning and would drop a re-signed certificate. One legacy store terminal also uses a self-signed client certificate for mutual TLS. Which Decryption policy configuration meets all three requirements?

In a Decryption policy, rules match traffic using configured criteria and apply an action such as Decrypt or Do Not Decrypt. The action on the matched traffic determines whether the firewall decrypts the TLS session for inspection and, when configured to do so, re-signs it with its own certificate. Decrypting the payment CDN session makes its payload available to intrusion rules, meeting the inspection requirement. Do Not Decrypt lets the banking sessions pass through without the firewall re-signing their certificates, preserving compatibility with certificate pinning. It also avoids the firewall terminating the terminal’s mutual TLS session, which uses a self-signed client certificate. Decrypting broadly risks breaking the pinned apps, because they may reject a certificate that differs from the one pinned in the app. Exempting the CDN from decryption fails the inspection requirement because intrusion rules cannot inspect the encrypted payload. Decrypting the CDN and banking sessions together risks breaking the pinned apps. In practice, verify that a CDN session is decrypted for inspection and that the banking app connects successfully.