topic Re: PA-820 random Decyption Error in Next-Generation Firewall Discussions

PA-820 random Decyption Error

PolymerHolding — Thu, 05 Sep 2024 12:48:20 GMT

Since a few month we got more and more random outbound decryption errors. When the user wait a moment the website will automatically open correct. The browser error messages are "err_connection_reset" or net:err_cert_authority_invalid". In the decryption error log i see errors like "certificate verifiy failed", "malloc failure", "General TLS protocol error". At the moment i have installed the Version 10.2.10-h4 at our PA-820 (HA). Did anyone have the same problems. I have an opened a ticket and at the moment i wait for further actions.

Re: PA-820 random Decyption Error

Raido_Rattameister — Thu, 05 Sep 2024 12:55:11 GMT

Identify site where decryption is failing.

Go to SSLLabs and run test.

Does website include intermediate certificate or is it extra download?

If website is not sending intermediate then Linux based machines (including Palo firewall) don't download it.

Re: PA-820 random Decyption Error

PolymerHolding — Thu, 05 Sep 2024 13:11:33 GMT

This isn´t a problem with the sites ( like missing Intermediate Certificate). I open a site and i get the error message. When i close the site and open it a little bit later again the site will be correct loaded (our when i leave the site and refresh it a little bit later). I think it a decryption performance problem but we can´t see it in the firewall.

Re: PA-820 random Decyption Error

Raido_Rattameister — Thu, 05 Sep 2024 14:06:51 GMT

One of your errors was "certificate verifiy failed".

Does it make any difference if you temporarily (just for testing) uncheck "Block sessions with unknown certificate status" and "Block sessions on certificate status check timeout" under Decryption Profile?

Re: PA-820 random Decyption Error

PolymerHolding — Fri, 06 Sep 2024 06:27:49 GMT

I have test it. It didn´t make any difference.