topic Decryption: Client and decrypt profile version mismatch in Next-Generation Firewall Discussions

Decryption: Client and decrypt profile version mismatch

LCMember40912 — Fri, 16 Feb 2024 19:15:25 GMT

Hi folks,

Have been seeing a lot of "'Client and decrypt profile version mismatch. Supported client version bitmask: 0x08. Supported decrypt profile version bitmask: 0x60. ' errors in the log lately. This article:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs/decryption-log-errors-and-error-indexes

indicates that the client is trying TLS 1.0, whereas the decryption profile only supports > TLS 1.2. I don't see how this could be since the clients generating these are all fully updated Win10, which should use TLS 1.2 by default. I've checked in the 'Internet Options' control panel item on these clients and TLS 1.2 is in fact selected. I've tried to get packet captures, but these happen at random times to random IP adresses, so it has been difficult. My only thought is that some application is attempting to force a connection using TLS 1.0? Any other thoughts on what it could be?

Thanks!

Re: Decryption: Client and decrypt profile version mismatch

IanLobdell — Wed, 16 Oct 2024 15:52:05 GMT

I am having this same problem with a specific site. www.wordstream.com it triggers 100% of the time. I've even tried to lower my decryption policy to accept TLSv1.0 and it still fails with a similar error: Client and server version mismatch. Supported client version bitmask: 0x08.

Previous to the downgrade attempt in my decryption profile I had the exact same error as you. I'm wondering if whatever is on the front end of this site is sending some odd requests back. Feel free to test with this site as it fails for me it will hopefully fail for you with the same error.

Re: Decryption: Client and decrypt profile version mismatch

mariolopez — Tue, 29 Oct 2024 22:41:13 GMT

Hello,

Have you had any luck resolving this issue? Running into that exact issue on one of our sites.

Re: Decryption: Client and decrypt profile version mismatch

moorek — Wed, 25 Jun 2025 18:11:04 GMT

Resurrecting this thread, as I'm having this issue with sites using proper TLS versions. Win10/11 PCs with updated browsers. "SSL Protocol Error" in Edge/Chrome. Not in Firefox. Only when the firewall and our forward trust cert is in the middle....just now poking around with it.