topic Re: Decryption exception issue - no SNI - SCN: chat.signal.org in Next-Generation Firewall Discussions

Decryption exception issue - no SNI - SCN: chat.signal.org

JarerkZajac — Thu, 23 Jun 2022 14:26:35 GMT

Hi,

how to add following decryption error (ssl-forward-proxy) to exceptions?

- logs->decryption: dest address: ac88393aca5853df7.awsglobalaccelerator.com (shodan solves this ip /13.248.212.111/ also to service.signal.org; SNI - no value; SCN: chat.signal.org; error: General TLS protocol error

- logs->traffic: destination like above; decrypted: no; app: ssl; session end reason: decrypt-cert-validation; action: allow; type: end

What I have done:

- device->cert management->SSL decrypt exclusion: chat.signal.org and *.signal.org -> exclude from decryption

Other (almost all) exceptions work fine, but only this cert has no value for SNI (Server Name Indication).

Re: Decryption exception issue - no SNI - SCN: chat.signal.org

aleksandar.astardzhiev — Thu, 07 Jul 2022 12:41:39 GMT

Hi @JarerkZajac ,

You can create Decryption rule, matching by destination address and using FQDN object with action set to "no decrypt"

Re: Decryption exception issue - no SNI - SCN: chat.signal.org

JarerkZajac — Thu, 19 Jan 2023 10:16:36 GMT

Hi Astardzhiev,

thank you for answer and apologise for late reply. I solved this problem by adding FQDN to URL custom category and using it in decryption rule as no decrypt url category.

Chat.signal works fine, but lately another: signal messenger started the same -> no SNI, no SCN (subject common name), at the same IP/FQDN address. So I added new decrypt rule and added this address.

Thank you again for reply and solution.

Best

Jarek