topic Re: Unsupported cipher. Supported client cipher bitmask: 0x00000000 in General Topics

Unsupported cipher. Supported client cipher bitmask: 0x00000000

Moritz — Tue, 04 Jan 2022 20:27:28 GMT

Hi,

have a decryption policies for inbound ssl decryption to a webpage. Therefor I have included the private Certificate.

At decryption monitor there is a message:

( error eq 'Unsupported cipher. Supported client cipher bitmask: 0x00000000. Supported decrypt profile cipher bitmask: 0x00000014.' )

Found this link https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-troubleshooting-workflow-examples/troubleshoot-unsupported-cipher-suites.html but my bitmask is 0x00 ?

How can I fix it? I chose the strict ssl control decryption profile but no help.

Re: Unsupported cipher. Supported client cipher bitmask: 0x00000000

kiwi — Wed, 05 Jan 2022 14:47:48 GMT

Hi @Moritz ,

Supported cipher suites will vary depending on your PAN-OS version. What's your current version and how is your decryption profile configured ?

As an example, some earlier PAN-OS versions only supported DHE or ECDHE for SSL Forward Proxy (it wasn't not supported for Inbound Inspection).

You might want to do some more debugging and check on which cipher suite client/server agree upon in the SSL handshake and compare that to the compatibility matrix to see if it's actually supported:

https://docs.paloaltonetworks.com/compatibility-matrix/supported-cipher-suites.html

Hope it helps

-Kiwi.

Re: Unsupported cipher. Supported client cipher bitmask: 0x00000000

Moritz — Wed, 05 Jan 2022 17:02:28 GMT

Hi @kiwi ,

I have a PA220 with PANOS 10.0.8.
As Decryption profile I tested none, default and Strict SSL:

How can I debug this. Trace a request and look into the SSL header? Have not done anything like this before. No experience with it.

Re: Unsupported cipher. Supported client cipher bitmask: 0x00000000

BPry — Wed, 05 Jan 2022 19:20:56 GMT

@Moritz,

You need to look at the supported cipher suite document that @kiwi linked and pass that along to the person running your web server or load balancer. The website and the firewall need to have the same ciphers enabled so that the firewall can actually proxy the traffic. There's not a magic solution to this one, you need to work with your web admin.

Re: Unsupported cipher. Supported client cipher bitmask: 0x00000000

kiwi — Thu, 06 Jan 2022 09:30:23 GMT

Hi @Moritz ,

What @BPry said 🙂 !

My guess is that the web server offers a cipher suite that the PA doesn't support. If you can run a PCAP you should be able to capture the SSL handshake and get information on the cipher suite being used.

Hope this helps,

-Kiwi.

Re: Unsupported cipher. Supported client cipher bitmask: 0x00000000

William-Wu — Sat, 31 Aug 2024 03:57:43 GMT

( error eq 'Unsupported cipher. Supported client cipher bitmask: 0x00000000. Supported decrypt profile cipher bitmask: 0x00000014.' )

According to the reference article linked below, the cipher bitmask: 0x00000000 means that the firewall doesn't support the cipher.

Reference: https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/decryption/troubleshoot-and-monitor-decryption/decryption-logs/decryption-log-errors-and-error-indexes