topic Re: Certificate error when accessing Gmail using SSL Decryption in General Topics

Certificate error when accessing Gmail using SSL Decryption

MohamedSharief — Mon, 31 Oct 2016 11:59:29 GMT

Hi,

I've implemented SSL Decryption in our environment and it worked find for most of the domains but "sometimes" when we access Gmail using Chrome it will give us a certificate error.

We are using internal CA and the Root certificate was distributed to all machines using GPO. I checked the trusted CA on Chrome and the certificate was there, deleted it and imported it manually and still the same error. Using IE, gmail is accessible but really slow.

When I stop SSL Decryption policy gmail is accessible.

No URLs were specified in the URL tab of the policy.

Is this behavior might be because we implemented User-ID recently? Mapping still not stable and we are getting some sources as Unknown.

Kindly let me know if you have any ideas.

Re: Certificate error when accessing Gmail using SSL Decryption

MohamedSharief — Mon, 31 Oct 2016 12:19:06 GMT

Update:

-Chrome has been updated to latest version.

-Reset the certificate cache using:

debug dataplane reset ssl-decrypt certificate-cache

Still the same issue.

Re: Certificate error when accessing Gmail using SSL Decryption

C-Dog — Mon, 31 Oct 2016 13:03:45 GMT

Does it give a certificate error in other browsers, firefox, IE, etc. and whats the message from the certificate error?

Regards,
Conan

Re: Certificate error when accessing Gmail using SSL Decryption

MohamedSharief — Mon, 31 Oct 2016 13:28:50 GMT

No, only in Chrome and only when accessing Gmail.

The error message is "your connection is not secure".

Re: Certificate error when accessing Gmail using SSL Decryption

C-Dog — Mon, 31 Oct 2016 15:17:10 GMT

Just want to double check this is Chrome, "Your connection is not secure!" is a Firefox error message, Chrome would be "Your connection is not private!".
Article below would explain this if it's Firefox.
- https://live.paloaltonetworks.com/t5/Configuration-Articles/After-Configuring-SSL-Decryption-Mozilla-Firefox-Presents/ta-p/52966

-Conan

Re: Certificate error when accessing Gmail using SSL Decryption

Brandon_Wertz — Mon, 31 Oct 2016 17:22:16 GMT

When users get the "not secure" message are they able to proceed and accept the risk or are they prevented from continuing on?

If they're not allowed to continue on can you confirm that you aren't using a SHA1 signed cert? Newer versions of Chrome do not support SHA1 certs any longer. I think about a month ago now, maybe a bit longer.

Re: Certificate error when accessing Gmail using SSL Decryption

MohamedSharief — Thu, 03 Nov 2016 10:31:17 GMT

Hi All,

Thanks for the effort guys, really appreciate it.

The issue was quic application, a simple deny rule for quick app-id solved the problem.

Resolved by the below URL:

https://live.paloaltonetworks.com/t5/Management-Articles/Blocking-QUIC-Protocol/ta-p/120207

Regards,

Sharief