topic Re: SSL decryption fails in General Topics

SSL decryption fails

montgomery — Thu, 15 Aug 2013 13:37:52 GMT

We are testing SSL decryption on our PA at the moment. We have found a site that could not be decrypted: https://posteo.de/

Has anyone of you an idea why the decryption fails for that site?

And how could I troubleshoot such problems? Because the normal log does not show any problem, but the browser shows an error message.

Thank you!

Re: SSL decryption fails

kprakash — Thu, 15 Aug 2013 14:04:50 GMT

Good Morning,

I just checked the certificate for https://posteo.de/ and it is signed by StartCom. It also has an intermediate certificate as shown.

Can you verify if Startcom is part of the Default Trusted Certificate Authorities?

Are you being presented with a forward Untrust Certificate? Also are we "Blocking sessions with untrusted issuers" ?

BR,

Karthik

Re: SSL decryption fails

hag — Thu, 15 Aug 2013 14:45:00 GMT

Hi Karthik,

Can you verify if Startcom is part of the Default Trusted Certificate Authorities?

- Yes it is part of the default trusted certificate authorities

Are you being presented with a forward Untrust Certificate?

- No certificate is shown. IE just shows "This page cannot be displayed"

Also are we "Blocking sessions with untrusted issuers" ?

- No.

Thanks!

Re: SSL decryption fails

kprakash — Thu, 15 Aug 2013 15:22:30 GMT

From what you have stated, it looks like we are either not seeing the entire TCP handshake completing for the SSL traffic, or there are some parameters on the Server Certificate that the PANFW doesnt like. If you set the action to No-Decrypt under the Decryption profile, does the webpage load?

Best regards,

Karthik RP

Re: SSL decryption fails

hag — Thu, 15 Aug 2013 15:35:52 GMT

Yes when we do no decrypt the page is loading as expected.

Re: SSL decryption fails

kprakash — Thu, 15 Aug 2013 15:59:53 GMT

It failed on our end as well, although we decrypted the traffic.