The show system setting ssl-decrypt certificate command is the designated PAN-OS CLI command to view the configured certificates for SSL Decryption. This command displays the specific certificates assigned to the roles of Forward Trust, Forward Untrust, and SSL Inbound Inspection. It is the standard operational command for verifying which certificates are actively configured for these decryption functions, which is a primary step in troubleshooting SSL Decryption issues related to certificate trust.

B: The command syntax is incorrect. The correct keyword is the singular certificate, not the plural certs.

C: This is a debug command used for advanced, real-time dataplane troubleshooting, not for viewing the static certificate configuration.

D: This command displays the cache of certificates that the firewall has dynamically signed, not the primary configured certificates like Forward Trust.

1. Palo Alto Networks. (2021). PAN-OS® CLI Quick Reference 10.2. Page 121. Retrieved from Palo Alto Networks Technical Documentation. The guide lists show system setting ssl-decrypt certificate with the description "Display SSL Decryption certificate settings."

2. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide 10.2. In the "Troubleshoot SSL Forward Proxy" section

initial verification steps involve checking the configured certificates. The show system setting ssl-decrypt certificate command directly provides this required information from the CLI.

3. Palo Alto Networks. (2021). PAN-OS® Administrator's Guide 10.2. In the "Configure SSL Forward Proxy" section

after configuring the Forward Trust and Forward Untrust certificates

this show command is the CLI method to verify the configuration has been applied correctly.