topic SSL Decryption in General Topics

SSL Decryption

RC-BHF — Thu, 24 Mar 2016 10:11:24 GMT

Hello

We have recentley tuned on SSL Decryption for some users.

Since then we are getting some SSL sites that cannot be accessed due to cypher mismatch. It is something we were exepcting, but not the amount of URL this is happneing for.

My question, is there a setting that I can turn on that will allow the site to be accessed if the SSL Decryption fails ?

My assumption is that most sites will get decrypted and we will get the relevant APP-id data from it.

Thanks

Re: SSL Decryption

santonic — Thu, 24 Mar 2016 10:19:40 GMT

You can decide what you want to do with sites that can't be decrypted in SSL forward proxy options in decryption profile:

Unsupported Mode Checks

Block sessions with unsupported versions

Block sessions with unsupported cipher suites

Block sessions with client authentication

Re: SSL Decryption

kiwi — Thu, 24 Mar 2016 13:35:22 GMT

On the more recent PAN-OS versions, if a site is using an unsupported cipher then it is added automatically to the ssl-decrypt exclude cache and will no longer be decrypted :

SSL-decrypt-exclude-cache-and-unsupported-cipher-suites