When deploying SSL Forward Proxy decryption, a forward trust certificate must have a subject alternative name (SAN) and be a server certificate. SAN is an extension to the X.509 standard that allows multiple domain names to be protected by a single SSL/TLS certificate. It is used to identify the domain names or IP addresses that the certificate should be valid for. A private key is also required but it is not mentioned in the options. A certificate authority (CA) certificate is not required as the forward trust certificate itself is a CA certificate.

https://docs.paloaltonetworks.com/panorama/10-2/panorama-admin/manage-log-collection/configure-log-forwarding-to-panorama

To address the issue of excessive SSL traffic, the administrator should configure QoS on both the ingress and egress interfaces for the traffic flows. This will allow the administrator to control the bandwidth allocation and priority of different applications based on their QoS classes. The administrator should also define a QoS profile that specifies the traffic classes and their guaranteed bandwidth percentages. The QoS profile can then be applied to a QoS policy rule that matches the SSL traffic based on source and destination zones or other criteria. Reference: : https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/quality-of-service/configure-qos