topic Re: Chrome (HSTS) NET::ERR_CERT_AUTHORITY_INVALID - with 10.1.14h4 update in General Topics

Chrome (HSTS) NET::ERR_CERT_AUTHORITY_INVALID - with 10.1.14h4 update

AlonTabak — Tue, 19 Nov 2024 20:53:39 GMT

We updated PANOS (on Friday before h6 was released on Sat) to 10.1.14-h4, rebooted and now our users are sporadically complaining about when using google Chrome (Edge not effected), getting a "Your connection is not private" NET::ERR_CERT_AUTHORITY_INVALID - specifically going to some banking sites (Chase.com, being a major culprit). Doesn't happen to everyone, and is very sporadic, then starts working later on. The only change we did was the 10.1.14 upgrade. We are not decrypting financial sites, and you can see Chase's cert in chrome - however adding to no-decrypt sometimes helps the user. I noticed our user-decrypt-profile is limited to TLS 1.2 (so maybe that's the issue) but called support (hasn't been helpful) next step is updating to h6. Any ideas or suggestions would be greatly appreciated! thanks in advance

Re: Chrome (HSTS) NET::ERR_CERT_AUTHORITY_INVALID - with 10.1.14h4 update

JayGolf — Wed, 20 Nov 2024 04:07:41 GMT

Hi @AlonTabak ,

Its likely that the websites you are getting those errors on are using tls 1.3:

Test this out by modifying your decryption profile and set min version to 1.2 and max version to max.

Re: Chrome (HSTS) NET::ERR_CERT_AUTHORITY_INVALID - with 10.1.14h4 update

AlonTabak — Wed, 20 Nov 2024 14:25:53 GMT

Thanks for the recommendation but no dice (just yet). Added TLS 1.3/Max as an option (which is good to have in either case), but still an issue with specific banking sites Chase, Merril, etc (only for some users). Palo support recommends flow based debugging as a next step, and I'm upgrading to the latest 10.1.14-h6 on Friday as another option.