topic Re: SSL decryption, which version of SSL is used ? in General Topics

SSL decryption, which version of SSL is used ?

loosj — Wed, 05 Dec 2012 10:29:09 GMT

All,

We have implemented SSL decryption for a customer. The certificate used on the PA is the same as on the server.

Our systems are scanned weekly by Qualys. One of the vulnerability is the following:

1/ SSL Server has SSLv2 Enabled Vulnerability

Solution:

Disable SSLv2

2/ SSL Insecure Protocol negotiation weakness

Solution:

OpenSSL has released new versions to address this issue.

After some debugging we have the following result as in attachment.

Can we conclude that the PA is using SSLv2? And if so how can we change it (to use SSLv3 or TLS) to get rid of the above vulnerability?

rgds

Johan

mbutt — Wed, 05 Dec 2012 21:36:10 GMT

Hi Johan,

Please look at the following post

Let us know if this helps.

Thank you

Numan

loosj — Thu, 06 Dec 2012 09:08:35 GMT

I've read this post, PAN is using openssl. But which version of SSL is the on the device, version 2 or 3 protocols ?

At this time openssl 1.0.1b is released.

rgds