topic Re: Safari Security Errors in General Topics

Safari Security Errors

kevin.shain — Fri, 01 Apr 2011 10:44:30 GMT

I have suddenly started getting security certificate errors while using Safari. I am not using a Captive Portal and have no certificates on the PAN, however the certificate errors always point back to a self-signed certificate by the PAN. I am attaching a screen cap as an example, however please note that the ip #'s it lists vary and they are not my ip #'s.

Re: Safari Security Errors

pkruse — Fri, 15 Apr 2011 18:15:31 GMT

Are you using SSL Decrypt? You would have to use a cert if this is the case. An ssl decrypt session acts like a proxy and could create the type of issue you are describing.

~Phil

Re: Safari Security Errors

kevin.shain — Fri, 15 Apr 2011 18:22:22 GMT

I have no rules set under Policies > Decryption, so I am assuming that means I am not using SSL Decrypt? Not sure if there is anywhere else to look or not.

Thanks.

Re: Safari Security Errors

bpappas — Fri, 15 Apr 2011 18:25:13 GMT

if you have no rules under Policies -> Decryption then you are not using SSL decrypt.

are you using a self-signed certificate for the web UI of the Palo Alto firewall?

-Benjamin

Re: Safari Security Errors

kevin.shain — Fri, 15 Apr 2011 18:44:27 GMT

Yes, I am using a self signed certificate for the web gui.

Thanks!

Re: Safari Security Errors

bpappas — Fri, 15 Apr 2011 18:59:02 GMT

Did you purge your certificate store on Safari? Or maybe you did an upgrade that purged your store of trusted certs?

Either way you can decide to trust the self-signed cert for the web UI of the PAN and that would stop the pop-up.

-Benjamin

Re: Safari Security Errors

kevin.shain — Fri, 15 Apr 2011 23:15:06 GMT

The popup does not happen on the web gui, it happens on random websites, mostly when a banner ad or something else is trying to load. The IP # is not one of mine however it says that the certificate is the self signed one from the PAN. Makes no sense, but I've seen it happen on multiple machines.

Re: Safari Security Errors

bpappas — Fri, 15 Apr 2011 23:21:35 GMT

Are you using captive portal? URL filtering?

I'm trying to isolate what may be causing the "response page" from the PAN device.

-Benjamin

Re: Safari Security Errors

kevin.shain — Fri, 15 Apr 2011 23:24:42 GMT

No captive portal, but we do filter URLs.

Thanks!