PCNSA Decryption and Monitoring Practice Question
Exhibit
1. 2023/08/15 10:30:45, info, ssl-decrypt, session 12345, Decryption failed: certificate validation error: certificate is not yet valid
Refer to the exhibit. A firewall log shows a decryption failure for a session. What is the most probable cause?
⚠ Common exam trap
Palo Alto Networks often tests the distinction between certificate expiry (notAfter) and certificate not-yet-valid (notBefore), where candidates mistakenly assume any decryption failure is due to an expired certificate rather than a clock skew issue.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall's system time is ahead of the certificate's validity start
When the firewall's system time is ahead of the certificate's validity start (the 'not before' date), the firewall considers the certificate as not yet valid. During SSL/TLS decryption, the firewall validates the server certificate's time constraints against its own system clock. If the firewall's clock is ahead, the certificate appears to be from the future, causing a decryption failure even though the server and client clocks may be correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The firewall's system time is ahead of the certificate's validity start
Why this is correct
The certificate's valid-from date is in the future relative to the firewall's clock.
- ✗
The server's certificate is expired
Why it's wrong here
An expired certificate would show 'certificate has expired', not 'not yet valid'.
- ✗
The decryption profile rejects self-signed certificates
Why it's wrong here
Rejecting self-signed would show a different error, not 'not yet valid'.
- ✗
The client's system time is behind
Why it's wrong here
Client clock does not affect the firewall's certificate validation.
Go deeper
Related to this question
About these practice questions
This PCNSA question is part of Courseiva's 516-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.