topic Re: General TLS protocol Error in General Topics

General TLS protocol Error

Salathiwe — Wed, 26 Jun 2024 13:50:06 GMT

We have forward proxy (ssl decryption configured)

We are having intermittent access to some webpages users have to reload the page to gain access.
We are seeing General TLS Error on the decryption logs under Error.

What Iv found out about the error is that

This message indicates that an error doesn't meet the criteria for any of the aforementioned protocol errors

Re: General TLS protocol Error

BPry — Wed, 26 Jun 2024 23:33:52 GMT

@Salathiwe,

Unfortunately that particular error message doesn't give you much to go off of from a troubleshooting aspect. The best step forward is taking a PCAP and look through to validate that everything looks good from the logs as far as what the server is exchanging and what the firewall itself actually supports.

Re: General TLS protocol Error

MP18 — Tue, 12 Nov 2024 16:19:12 GMT

@Salathiwe Normally this means that Server only supports TLS1.3

This is what i have seen so far. Make sure on Firewall Decryption Profile - TLS version - TLS1.3 is selected.

Regards

Re: General TLS protocol Error

Salathiwe — Thu, 14 Nov 2024 09:34:54 GMT

Thank will look into that

Re: General TLS protocol Error

Adrian_Jensen — Tue, 19 Nov 2024 16:49:01 GMT

In addition, when debugging SSL decrypt problems I also recommend running SSLLabs "Test Your Server" on the endpoint server. I have come across quite a few TLS/1.2 and 1.3 capable public servers that deliberately choose weak encryption algorithms for TLS/1.2 (server side prefers weak ciphers before strong). After successful TLS/1.2 negotiation the server then tries to upgrade the connection to HTTP/2.0, which explicitly forbids weak ciphers, causing the TLS/1.2 to abort. When doing a TLS/1.3 connection everything works fine as 1.3 requires strong ciphers to start. So the server is actually causing the problem, not the PaloAlto.