topic Decryption failed in Next-Generation Firewall Discussions

Decryption failed

HY_Cheng — Mon, 15 Jul 2024 08:58:33 GMT

Hi guys ,

PA820 . OS Version 10.2.9-h1

I am try using the decryption function to see more application information
I generated the CA certificate from PA and imported it locally.

From the decryption log, I saw many errors with various URLs.
Can anyone help explain how to eliminate this?

error eq 'Received fatal alert CertificateUnknown from client. CA Issuer URL (truncated):http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1'
URL: http://aia.entrust.net/l1k-chain256.cer'

Re: Decryption failed

CosminM — Mon, 15 Jul 2024 09:14:39 GMT

Hello @HY_Cheng

It seems like you're dealing with a classic incomplete chain issue.

This often occurs with SSL/TLS certificates when the server doesn't provide the full certificate chain, excluding the root certificate.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs/repair-incomplete-certificate-chains

Re: Decryption failed

rmfalconer — Tue, 16 Jul 2024 16:12:48 GMT

What exactly did you do when you generated the CA certificate from PA and imported in locally?

Re: Decryption failed

HY_Cheng — Fri, 19 Jul 2024 01:41:43 GMT

I followed the file settings, and the text did not mention the need for a complete certificate chain.

Only use self-signed CAs and choose to forward trust certificates

From the traffic log, I can see that the appplication can be identified, but I still see a similar error in the decryption log. Is it necessary to complete the credential chain for a specific connection to eliminate this problem?
Any ideas?

Thank you so much

https://knowledgebase-paloaltonetworks-com.translate.goog/KCSArticleDetail?id=kA10g000000ClmyCAC&_x_tr_sl=auto&_x_tr_tl=zh-TW&_x_tr_hl=zh-TW

Re: Decryption failed

HY_Cheng — Fri, 19 Jul 2024 01:44:33 GMT

I followed the documentation settings, generated a self-signed CA and chose to forward the trust certificate
Import the local trusted root certificate authority and set the porfile/policy
Try to connect to check the traffic

https://knowledgebase-paloaltonetworks-com.translate.goog/KCSArticleDetail?id=kA10g000000ClmyCAC&_x_tr_sl=auto&_x_tr_tl=zh-TW&_x_tr_hl=zh-TW

Re: Decryption failed

rmfalconer — Tue, 23 Jul 2024 13:06:32 GMT

What type of client are you using? Are they Windows machines? If so, when you browse the Trusted Root Certification Authorities store, do you see it there?