topic Re: Google disclaimer and SSL Decryption in General Topics

Google disclaimer and SSL Decryption

Laurent_Dormond — Wed, 07 Sep 2016 08:57:19 GMT

Hello,

I have enabled SSL decryption on a PA-500 running PanOS 7.0.9 for testing purposes (before enabling in prod environment).

All seems to be working fine, except with the Google Disclaimer that randomly occurs and that you have to agree with in order to go ahead with your google searches...

Without SSL decryption it displays normally, but with SSL decryption enabled, it only displays a empty (white) frame and the end user can't agree and thus stucks on this page...

There is nothing denied or blocked by any PanOS feature, test policy is "any any allow".

This is occuring with IE 11 (not tested with another browser).

Does anymone ever experienced this issue ?

Regards,

Laurent

Re: Google disclaimer and SSL Decryption

Brandon_Wertz — Wed, 07 Sep 2016 12:17:41 GMT

Not for me.

Running IE 11.0.9600

Maybe try a PCAP from the palo and see what's happening. That's really only been my recourse when technical SSL issues like you're having.

Re: Google disclaimer and SSL Decryption

bbilut — Wed, 07 Sep 2016 13:59:40 GMT

Sounds like maybe your SSL cert is not loaded on your computers as a "Trusted Root Certification Authority"

I decrypt all our Google traffic so I can enforce safe search, youtube safety-mode, and others. We don't have any problems in Chrome or IE, but Firefox has it's own certificate store and doesn't use Windows.

Re: Google disclaimer and SSL Decryption

Laurent_Dormond — Wed, 07 Sep 2016 15:00:33 GMT

Hi Brad,

indeed, my ssl cert is not loaded as "Trusted Root CA cert", since it is just SSL decrypt test purposes.

Also I have the "untrusted issuer warning" message in the browser for each decrypted HTTPS website, but it is not a problem for the instance.

To add some more visual description of the problem, here are two screenshot with and without ssl decrpytion :

Here with SSL decryption deactivated

Here with SSL decryption enabled

Re: Google disclaimer and SSL Decryption

BPry — Wed, 07 Sep 2016 15:07:48 GMT

So I'm just going to take an educated guess here after seeing your screen but without your ssl decryption cert being trusted you would have to 'allow' the connection to continue. Since Google isn't pulling that resource from the same server (you can test this with the dev tools network monitoring) it isn't loading the resource because you haven't actually allowed that action to continue with the untrusted cert. If you add that cert into your trusted store then you should see this issue go away.

Re: Google disclaimer and SSL Decryption

Laurent_Dormond — Wed, 07 Sep 2016 15:23:46 GMT

Hi,

That sounds good indeed, I will try out and let you know the result.

I remember in the PCAP captures that there were a lots of SSL handshakes (client hello, server hello, ...) that probably means that there are multiple SSL connexions to different resources.

Thanks for the advice.

Regards,

Re: Google disclaimer and SSL Decryption

bbilut — Wed, 07 Sep 2016 15:31:32 GMT

What you're decryption profile look like? This is how I have mine set (it's pretty loose).

Re: Google disclaimer and SSL Decryption

Laurent_Dormond — Wed, 07 Sep 2016 15:42:46 GMT

Ok adding the self-signed cert to the Trusted root CA cert store fixed this issue.

Many thanks for your help.

Regards

Re: Google disclaimer and SSL Decryption

Brandon_Wertz — Wed, 07 Sep 2016 16:05:50 GMT

@Laurent_Dormond From the PCAP you should have been able to see an "untrusted certificate" alert

Re: Google disclaimer and SSL Decryption

bbilut — Wed, 07 Sep 2016 16:08:18 GMT

FYI: We push our cert out to Windows machines with group policy, iOS devices with our MDM solution (Airwatch), and to our Chromebooks with the Google Mgmt console. That only leaves personal devices (byod), so we put the cert up on our web site with instructions on who to install it.