CCNA Decryption Monitoring Questions

Why this answer

How to eliminate wrong answers

Option A is wrong because SSL Forward Proxy is designed to decrypt SSL/TLS traffic (HTTPS), not SSH traffic, which uses a different encryption protocol and port 22. Option B is wrong because Inbound Inspection is a general traffic inspection policy, not a specific decryption method; it does not inherently decrypt SSH or any encrypted protocol. Option D is wrong because Decryption Mirror is a passive monitoring feature that copies traffic to an external tool for analysis, but it does not perform active decryption of SSH sessions.

Why this answer

How to eliminate wrong answers

Option A is wrong because Palo Alto Networks firewalls support TLS 1.3 decryption in forward proxy mode since PAN-OS 9.0, so TLS 1.3 is not a blocking factor. Option B is wrong because the firewall's encryption algorithm settings in the SSL/TLS decryption profile control which cipher suites the firewall offers to the server; if there is a mismatch, the firewall would typically fall back to a mutually supported cipher rather than skip decryption entirely. Option C is wrong because blocking sessions with expired certificates would cause the session to be terminated or blocked, not silently bypass decryption; the traffic would still be evaluated by the decryption rule.

Why this answer

How to eliminate wrong answers

Option A is wrong because TLS 1.3 is fully supported by Palo Alto Networks decryption profiles, and disabling it would affect all clients, not just mobile devices. Option B is wrong because weak key length (e.g., 1024-bit RSA) would cause browser warnings but not outright connection failures on mobile devices; modern mobile OSes accept 2048-bit keys, which are standard. Option D is wrong because the firewall's decryption policy is based on source zones, IP addresses, or user groups, not device type; if mobile devices are in the same zone as other clients, they will be decrypted unless explicitly excluded.

Why this answer

How to eliminate wrong answers

Option A is wrong because if the decryption policy used 'No Decrypt' for the internal application's URL category, the traffic would bypass decryption entirely and should work normally, not fail. Option B is wrong because while performance bottlenecks can occur with heavy decryption, they would cause slowdowns or timeouts, not outright application failures due to certificate trust issues. Option D is wrong because decryption configuration for internal vs external zones does not directly cause application failures; the issue is the lack of trusted CA on endpoints, not the zone direction.

Why this answer

How to eliminate wrong answers

Option A is wrong because a 'Decrypt' action with destination zone 'Untrust' would decrypt all outbound traffic, including financial websites, violating compliance. Option C is wrong because a 'No Decrypt' rule for all traffic would prevent decryption entirely, defeating the purpose of SSL Forward Proxy; the rule order would not allow selective decryption. Option D is wrong because a 'Decrypt' action for 'Financial Services' would explicitly decrypt financial traffic, which is the opposite of the compliance requirement.

Why this answer

How to eliminate wrong answers

Option A is wrong because Palo Alto Networks firewalls do support wildcard certificates for inbound decryption; the issue is the decryption method, not the certificate type. Option B is wrong because the web server does not need special configuration for decrypted traffic—the firewall decrypts and re-encrypts transparently; the error is on the client side due to certificate mismatch. Option C is wrong because the decryption profile setting 'Block sessions with untrusted certificates' would block sessions and generate a decryption error in logs, but the logs show no decryption errors and the traffic is matched to the rule with no action taken, indicating the rule is misconfigured, not that the certificate is untrusted.

Why this answer

How to eliminate wrong answers

Option A is wrong because a 'strict' profile is related to SSL/TLS forward proxy settings (e.g., certificate validation, protocol version checks) and does not inherently block decryption; it only enforces security checks on decrypted traffic. Option B is wrong because a decryption profile does not block decryption itself; it controls actions like blocking sessions with expired certificates or unsupported cipher suites, but the rule's action (decrypt vs. no-decrypt) is set in the rule, not the profile. Option D is wrong because setting the source to 'any' in the 'Decrypt-Web' rule would actually broaden its match scope, not prevent decryption; the issue is rule order, not the source field.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because modifying the existing decrypt rule to decrypt all categories except those two would require excluding the categories within the same rule, but the correct approach is to use a separate 'No Decrypt' rule above the decrypt rule to ensure proper precedence and avoid unintended decryption of sensitive traffic. Option B is wrong because disabling decryption entirely for all student traffic is an overreaction that would eliminate security visibility for all web traffic, not just the problematic categories, and would not align with the goal of maintaining decryption for other sites. Option C is wrong because creating a security policy rule to allow traffic without inspection does not address the decryption issue; security policies control firewall actions (allow/deny), not decryption decisions, and the traffic would still be decrypted by the existing decrypt rule unless a decryption policy explicitly excludes it.

Why this answer

How to eliminate wrong answers

Option A is wrong because 'Decrypt' action would force decryption and re-encryption, causing the exact performance issue the engineer wants to avoid, and a custom URL category does not reduce overhead. Option B is wrong because 'No Decrypt' with certificate status check disabled means the firewall will not inspect the certificate at all, missing potential threats like expired or revoked certificates. Option D is wrong because 'Decrypt' action with source zone 'Untrust' still decrypts all traffic from that zone, increasing overhead unnecessarily for a public CA application that does not require decryption.

Why this answer

How to eliminate wrong answers

Option B (Decryption Mirror) is wrong because it is not a decryption method; it is a feature that copies traffic to a monitoring tool without decrypting it. Option C (Outbound (Forward Proxy) Decryption) is wrong because it is designed for decrypting traffic initiated by internal clients going to external servers, not inbound traffic to a web server. Option D (SSH Proxy) is wrong because it is used to proxy SSH connections, not to decrypt HTTPS traffic, and it does not apply to inbound web server inspection.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because decryption mirroring sends a copy of decrypted traffic to a monitoring appliance for analysis, but it does not offload the decryption itself; the firewall still performs the CPU-intensive SSL/TLS decryption. Option B is wrong because changing the decryption policy to 'no-decrypt' for all traffic completely disables decryption, which does not meet the requirement to reduce load without completely disabling decryption. Option C is wrong because disabling weak ciphers in SSL/TLS protocol settings improves security by preventing use of insecure algorithms, but it does not reduce CPU utilization from decryption; in fact, it may increase load by forcing negotiation of stronger ciphers that require more processing.

Why this answer

How to eliminate wrong answers

Option A is wrong because URL Filtering logs track web requests and URL categories, not the decryption bypass status of encrypted traffic. Option B is wrong because Threat logs record detected threats (e.g., malware, exploits) in decrypted or inspected traffic, not the bypass of decryption itself. Option D is wrong because Traffic logs show basic session information (source, destination, ports) but do not specifically indicate whether decryption was bypassed or the reason for bypass.

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing the decryption session timeout value does not reduce CPU utilization; it only keeps idle sessions open longer, potentially increasing resource consumption. Option C is wrong because the administrator has already upgraded to maximum licensed throughput and added a dedicated decryption engine, indicating the hardware is not the bottleneck; replacing the firewall would be a costly and unnecessary step without first optimizing the policy. Option D is wrong because SSL acceleration hardware offloading is typically already enabled on Palo Alto Networks firewalls that support it, and the issue persists despite having a dedicated decryption engine, meaning the problem is policy scope, not offloading capability.

Why this answer

How to eliminate wrong answers

Option A is wrong because a certificate expiration typically generates a system alert or log entry, but the question asks for the immediate impact on traffic, not the logging behavior. Option C is wrong because decryption does not stop; the firewall continues to intercept and re-encrypt traffic using the expired certificate, and SSL traffic is not blocked unless a specific policy action (e.g., 'block if certificate invalid') is configured. Option D is wrong because the firewall does not automatically renew certificates from a CA; certificate renewal is a manual or automated process managed by the administrator, not an automatic firewall function.

Why this answer

Why this answer

How to eliminate wrong answers

Option B (Policy Optimizer) is wrong because it is designed to analyze and recommend security policy rule changes based on traffic patterns, not to display real-time decryption statistics. Option C (Log Viewer) is wrong because it shows historical log entries (e.g., traffic, threat, or decryption logs) but does not provide a real-time aggregated view of decryption metrics like session counts or certificate errors. Option D (Reports) is wrong because it generates scheduled or on-demand historical reports from log data, not live decryption statistics.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because Threat Prevention alone cannot inspect encrypted traffic — it requires decrypted payloads to apply signatures, so it would miss threats in HTTPS sessions. Option C is wrong because SSL Decryption only decrypts traffic but does not perform any threat inspection; it merely makes the content visible but takes no action on threats. Option D is wrong because URL Filtering categorizes and controls access based on URLs, not threat inspection; it does not analyze decrypted content for malware or exploits, so it cannot replace Threat Prevention.

Why this answer

How to eliminate wrong answers

Why this answer

How to eliminate wrong answers

Option A is wrong because verifying the decryption certificate is a secondary step; if the policy is not matched, the certificate is never used. Option B is wrong because disabling the SSL/TLS service profile would break decryption entirely, not help diagnose why an existing policy is not being applied. Option D is wrong because importing the server's certificate is not required for outbound decryption (forward proxy) — the firewall generates its own certificate for the client, and the server's certificate is validated but not imported.

Why this answer

How to eliminate wrong answers

Option A is wrong because the client trusting the firewall's CA certificate is required for the client to accept the decrypted connection, but a 'certificate_unknown' error occurs during the firewall's validation of the server certificate, not during client-side trust checks. Option B is wrong because an expired server certificate would produce a different error, such as 'certificate_expired' or 'certificate_not_yet_valid', not 'certificate_unknown'. Option D is wrong because an incorrect source zone in the decryption policy would cause traffic to bypass decryption or be dropped, not generate a specific SSL decryption failure with the 'certificate_unknown' error.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if the decryption policy were set to no-decrypt, the firewall would simply pass the traffic without inspection, and the user would be able to access the HTTPS site normally (assuming no other blocks). Option C is wrong because a certificate revocation check failure would typically result in a warning or block only if the firewall is configured to enforce revocation, but the question states the decryption policy uses the default SSL/TLS service profile, which does not enable revocation checking by default. Option D is wrong because a self-signed server certificate would cause a warning in the client's browser regardless of decryption, but the question specifically describes a scenario where forward proxy decryption is enabled, and the issue is that the firewall's own certificate is not trusted by the client, not the server's certificate.

Why this answer

How to eliminate wrong answers

Option A is wrong because a private key mismatch would cause the SSL/TLS handshake to fail with a different error (e.g., 'decryption failed' or 'certificate unknown'), not a block specifically tied to certificate expiry. Option B is wrong because the client's system clock is irrelevant to the firewall's 'Block Expired Certificates' check; the firewall evaluates the certificate against its own clock, not the client's. Option C is wrong because the decryption policy references the service profile (which contains the 'Block Expired Certificates' setting), not the server certificate itself; the renewed certificate is correctly installed on the server, so the policy does not 'point' to an old certificate.

Why this answer

How to eliminate wrong answers

Option A is wrong because the issue is not about self-signed certificates; client certificate authentication typically uses certificates issued by an internal CA, and the SSL/TLS service profile does not block self-signed certificates by default. Option C is wrong because 'Block Unsupported Modes' prevents connections using unsupported TLS versions or cipher suites, not client certificate forwarding. Option D is wrong because the decryption policy must be set to 'decrypt' for SSL Forward Proxy to function; 'proxy' is not a valid action in the decryption policy.

Why this answer

How to eliminate wrong answers

Option B is wrong because the firewall does not block the connection by default; it proceeds with decryption using the server's certificate, leading to a warning. Option C is wrong because the firewall cannot re-encrypt with the partner's certificate; it uses its own CA-signed certificate for the client side, not the server's certificate. Option D is wrong because the firewall does not automatically trust self-signed certificates; it still attempts decryption and presents the server's certificate to the client.

Why this answer

How to eliminate wrong answers

Option B is wrong because setting action 'No Decrypt' for TLS 1.0 traffic would prevent the firewall from inspecting the encrypted content, but it would not actively detect or report the TLS version; the firewall would simply bypass decryption without generating an alert. Option C is wrong because using a Security policy rule to block TLS 1.0 traffic would break the connections, which contradicts the requirement to detect and report without breaking them. Option D is wrong because enabling 'TLS Version Check' with action 'block' would drop the TLS 1.0 connections, violating the requirement to not break them.

Why this answer

How to eliminate wrong answers

Option A is wrong because there is no rule conflict; the decryption policy explicitly defines a 'No Decrypt' action for the financial-services category, which is a valid and unambiguous configuration. Option B is wrong because the decryption policy does not block the session; 'No Decrypt' allows the traffic to pass without decryption, whereas a block would require a security rule with a deny action. Option D is wrong because the decryption policy action is 'No Decrypt', not 'Decrypt'; the firewall will not perform SSL/TLS decryption on this session.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an expired firewall certificate would cause a different error (e.g., 'certificate expired') or a warning to the client, not a generic 'SSL Handshake Failed' in the traffic log. Option B is wrong because the decryption policy's action being set to 'decrypt' is necessary for decryption to occur, but the error is about the SSL handshake itself, not the policy action; if the action were not 'decrypt', no decryption attempt would happen. Option D is wrong because an outdated browser would cause client-side errors (e.g., unsupported cipher or protocol), not a server-side handshake failure logged by the firewall.

Why this answer

How to eliminate wrong answers

Option B is wrong because the application being SSL does not automatically cause decryption; decryption only occurs if a decryption policy explicitly matches the traffic. Option C is wrong because the traffic was decrypted, as indicated by the log, so it could not have matched a no-decrypt policy. Option D is wrong because the destination is internal (192.168.1.1 is a private IP), not external, and even if it were external, decryption depends on policy, not destination type.

Why this answer

How to eliminate wrong answers

Option A is wrong because the SSL session cache size affects performance and renegotiation overhead, not the number of decryption failures; a small cache would cause more full handshakes but not failures. Option C is wrong because SSL Forward Proxy must be enabled for decryption to occur; if it were not enabled, there would be no decryption at all, not a high number of failures. Option D is wrong because non-HTTP traffic being decrypted would cause errors or performance issues, but the firewall typically only attempts decryption on allowed ports (e.g., 443), and this would not be the primary cause of a high failure count.

Why this answer

How to eliminate wrong answers

Option A is wrong because the decryption profile's 'decrypt' setting and forward proxy option are relevant for outbound SSL Forward Proxy decryption, not for inbound SSL Inbound Inspection, which uses a different configuration (the server's certificate). Option C is wrong because the server's certificate is not installed on the firewall for inbound inspection; instead, the firewall uses a copy of the server's private key and certificate (or a CA-signed certificate) to re-encrypt traffic, but the server's certificate is already on the server itself. Option D is wrong because the firewall does not need a 'valid certificate for inbound inspection' in the sense of a separate certificate; it needs the server's private key and certificate (or a certificate signed by a trusted CA) to perform SSL Inbound Inspection, but this is not the first troubleshooting step.

Why this answer

How to eliminate wrong answers

Option A is wrong because a decryption policy with the action 'decrypt' but no certificate profile would cause the firewall to fail to decrypt traffic entirely, not produce a browser certificate warning after decryption. Option C is wrong because TLS 1.2 support is unrelated to certificate trust warnings; if the browser did not support TLS 1.2, the connection would fail or fall back to an older version, not show a certificate warning. Option D is wrong because server certificate revocation would cause a different error (e.g., CRL or OCSP failure) and is not related to the firewall's own CA certificate not being trusted by the browser.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the client's certificate is used for client authentication (e.g., mutual TLS), not for inbound decryption; the firewall does not need the client's private key. Option C is wrong because a trusted CA certificate from the enterprise PKI is used to validate server certificates or to sign decryption certificates, but it does not provide the private key needed to decrypt traffic. Option D is wrong because the firewall's own self-signed certificate would not be trusted by clients for the server's domain, causing TLS handshake failures; it is typically used for forward proxy decryption, not inbound inspection.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the 'exclude cache' option is used to prevent caching of decrypted content, not to exclude traffic from decryption; it does not affect whether decryption occurs. Option B is wrong because a security policy alone cannot control decryption; decryption is governed by decryption policies, not security policies, and the order of policy evaluation requires a decryption policy to specify 'no-decrypt'. Option C is wrong because a decryption exemption is not a valid configuration in Palo Alto Networks firewalls; the correct method is to use a decryption policy with action 'no-decrypt'.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the certificate expiry warning is not merely informational; an expired decryption CA will break SSL decryption functionality, leading to service disruption. Option C is wrong because importing a new server certificate addresses individual server certificates, not the decryption CA certificate that signs them; the CA certificate must be renewed independently. Option D is wrong because disabling decryption until renewal is unnecessary and overly disruptive; the correct action is to proactively renew the CA certificate while the current one is still valid.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because blocking sessions with untrusted certificates would prevent access entirely, not cause certificate errors; the complaint is about errors, not blocked access. Option B is wrong because inbound inspection is used for decrypting traffic destined to internal servers, not for outbound SSL traffic from internal users to external websites, which requires forward proxy mode. Option D is wrong because even without a decryption profile attached, the decryption rule would still apply default decryption settings; the missing step is the certificate trust chain, not the profile attachment.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the maximum number of concurrent SSL sessions would increase the CPU load, not reduce it, as the firewall would attempt to handle more simultaneous decryption operations, worsening the high CPU issue. Option B is wrong because disabling decryption for high-bandwidth websites like video streaming services would reduce CPU load but would also bypass security inspection for a large volume of traffic, weakening the security posture and potentially allowing threats to hide in encrypted streams. Option D is wrong because the PA-5250 already has hardware acceleration for SSL decryption enabled by default; the issue is not a lack of hardware support but rather the CPU being overwhelmed by the sheer volume of decryption operations, and enabling it again would have no effect.

Why this answer

How to eliminate wrong answers

Option A is wrong because a decryption exclusion rule would prevent decryption of traffic between internal clients and the internal server, but it does not address the root cause—the inbound decryption rule incorrectly matching internal traffic—and may still allow the server's outbound decryption to cause certificate warnings. Option C is wrong because disabling outbound decryption for the internal server's subnet would prevent legitimate decryption of the server's outbound traffic to external resources, potentially breaking security inspection for that traffic. Option D is wrong because a no-decrypt rule for the internal server's IP to the internet only stops outbound decryption for that server, but does not fix the inbound decryption misapplication that causes the initial double-decryption when internal clients connect to the server.

Why this answer

How to eliminate wrong answers

Option B (Threat logs) is wrong because threat logs record malware, exploits, and vulnerability events, not decryption failures. Option C (URL Filtering logs) is wrong because URL filtering logs track website categorization and access decisions, not the cryptographic handshake or certificate errors. Option D (System logs) is wrong because system logs capture administrative events, system health, and configuration changes, not per-session decryption errors.

Why this answer

How to eliminate wrong answers

Option A is wrong because certificate errors would be logged as 'certificate validation failure' or 'certificate revoked' in the decryption session log, not as 'TLS version mismatch'. Option C is wrong because the decryption policy is being hit (sessions are being decrypted), as evidenced by the large number of decryption sessions; low policy hits would show few or no decryption sessions. Option D is wrong because the output does not provide any historical or peak data; the current session count could be high but there is no baseline to determine if it is at its peak.

Why this answer

How to eliminate wrong answers

Option A is wrong because an unreachable CRL server would cause certificate validation failures, not handshake failures; handshake failures occur before certificate validation in the SSL/TLS handshake. Option C is wrong because if the decryption policy is not matching the traffic, the firewall would simply not decrypt it (passing it through), which would not generate handshake failures. Option D is wrong because if the firewall's certificate is not trusted by clients, clients would generate certificate warnings or errors, but the handshake itself would complete; the failure would occur at the client's trust validation step, not during the handshake.

Why this answer

How to eliminate wrong answers

Option A is wrong because unsupported ciphers would cause a decryption failure or connection drop, not an 'untrusted certificate' warning; the warning is a client-side trust issue, not a cipher mismatch. Option B is wrong because the 'Unsupported Modes' setting in the decryption profile controls how the firewall handles traffic that cannot be decrypted (e.g., block or allow), not the trust status of a successfully decrypted and re-encrypted certificate. Option C is wrong because if the decryption policy were not matching the traffic, the firewall would not perform decryption at all, and clients would connect directly to the server without seeing any firewall-generated certificate; the 'untrusted certificate' warning specifically indicates the firewall is intercepting and re-encrypting, but the certificate chain is incomplete.

Why this answer

How to eliminate wrong answers

Option A is wrong because expired certificates cause a different error (e.g., 'certificate expired') and are handled by a separate profile setting; the question specifies 'decryption error' logs, not expiration errors. Option B is wrong because 'certificate status unknown' refers to OCSP/CRL verification failures, which are less common and typically produce a distinct log message; the default behavior is to allow sessions with unknown status unless explicitly blocked. Option C is wrong because unsupported cipher suites would cause a handshake failure before decryption even begins, and the firewall would log a 'handshake failure' or 'no shared cipher' error, not a generic 'decryption error'.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the default profile is only applied when a decrypt rule matches and no specific profile is assigned; a no-decrypt rule prevents any decryption from occurring. Option C is wrong because the inbound profile is used only when a decrypt rule with an inbound decryption profile matches; a no-decrypt rule overrides any profile assignment. Option D is wrong because decryption policy does not block traffic; it only determines whether decryption is applied, and security rules handle blocking independently.

Why this answer

How to eliminate wrong answers

Option B is wrong because an expired server certificate (past the 'not after' date) would also cause a decryption failure, but the scenario specifically describes the firewall's time being ahead, which points to the 'not before' issue, not expiry. Option C is wrong because the question does not mention a decryption profile rejecting self-signed certificates; the log shows a decryption failure, not a policy-based rejection. Option D is wrong because the client's system time is irrelevant to the firewall's decryption process; the firewall uses its own system clock to validate certificate validity, not the client's clock.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if the decryption policy were set to 'No Decrypt' for the affected users' source IP range, the firewall logs would show the session as not decrypted, but the logs explicitly state the session is being decrypted. Option B is wrong because SSH proxy is a separate feature for decrypting SSH traffic, not HTTPS; the firewall would not perform SSH proxy for HTTPS traffic, and the logs would indicate a different protocol. Option D is wrong because the application uses a valid certificate from a public CA, and time zone differences do not cause certificate expiration; certificate validity is based on UTC time, and the firewall would report an expired certificate in the logs if that were the case.

Why this answer

How to eliminate wrong answers

Option A is wrong because System logs capture system-level events (e.g., reboots, HA state changes, license expiration) and do not contain per-session decryption decisions or reasons for not decrypting. Option C is wrong because Traffic logs record session metadata (source/destination IP, ports, application, bytes) and may indicate if decryption was applied via a flag, but they lack the specific reason codes for why decryption was skipped or failed. Option D is wrong because Threat logs focus on detected threats (e.g., malware, exploits, spyware) and do not provide decryption-specific actions or exclusion reasons.

Why this answer

How to eliminate wrong answers

Option B is wrong because system logs record events after policy enforcement, but they do not affect the policy order; the issue is a misconfiguration in the policy sequence, not a logging deficiency. Option C is wrong because certificate revocation status (CRL/OCSP) is checked during SSL/TLS handshake validation, not for determining which traffic to decrypt; it is unrelated to policy rule ordering. Option D is wrong because SSL/TLS service profile settings define cipher suites and protocol versions for decryption, not the traffic matching logic that determines which sites are decrypted or excluded.

Why this answer

How to eliminate wrong answers

Option A is wrong because updating the CRL would not help if the certificate's revocation status is 'unknown' (i.e., the CRL or OCSP responder is unreachable or the certificate is not listed); the issue is not a stale CRL but a failure to obtain any revocation status. Option B is wrong because adding the websites to a decryption policy exception rule would bypass decryption entirely, which is an overreaction and would defeat the purpose of outbound SSL decryption for security monitoring; the issue is specific to certificate validation, not a need to exclude the sites from decryption. Option C is wrong because disabling blocking for untrusted issuers would allow sessions with certificates from untrusted CAs, but the logs indicate 'certificate validation failure' with 'certificate status unknown', not that the issuer is untrusted; this would weaken security unnecessarily and not address the root cause.