Palo Alto: We can block specific certificate signers at the firewall to help with the number 4.
Me: looks inside
Palo docs: Intermediate CAs are not installed into the Palo Alto certificate repository, as presenting a complete/valid chain is typically the responsibility of the hosting server.
Me:
