topic Re: "decrypt-unsupport-param" error on Inbound SSL Decryption in General Topics

"decrypt-unsupport-param" error on Inbound SSL Decryption

Maxstr — Thu, 05 Jan 2017 21:46:44 GMT

I am trying to get inbound SSL decryption for our web server. I imported our web server's SSL certificate with private key to the Palo. It shows "Valid" and the "private key" checkbox is checked.

But the log shows it is not getting decrypted, and I'm seeing the session end "decrypt-unsupport-param" .

The certificate is signed by a CA, 2048-bit, SHA256

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

OtakarKlier — Thu, 05 Jan 2017 23:10:52 GMT

Hello,

According to the documetnation, here is what it means:

The session used an unsupported protocol version, cipher, or SSH algorithm. This session end reason is also displayed when the session produced a fatal error alert of type unsupported_extension, unexpected_message, or handshake_failure.

https://www.paloaltonetworks.com/documentation/71/pan-os/newfeaturesguide/networking-features/ssl-ssh-session-end-reasons

I however do not know howto resolve it. I'm sure a ticket into TAC could be a quicker answer?

Hope this helps.

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

kdd — Fri, 06 Jan 2017 10:32:52 GMT

Hi,

please take a look at "objects > decryption profile" and here the default profil or the your own configured profile. Take the tab "SSL-Decryption " and then "SSL Protocol Settings". Now you can choose the Protocol Version, Key Exchange Algorithms, Encryption Algorithms and Authentication Algorithms. Hope this helps.

Regards,

Klaus

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

Maxstr — Fri, 06 Jan 2017 14:53:44 GMT

Ok, I checked the decryption profile, and the default already has every option checked. Seems to be some other issue then

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

kdd — Fri, 06 Jan 2017 14:59:07 GMT

hi,

i think it is nessesary to debug. Maybe the it is an unsupport cipher.

Regards,

Klaus

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

kdd — Fri, 06 Jan 2017 15:02:16 GMT

another thing is to check the decryption policy for right Decryption Profil ...

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

Maxstr — Fri, 06 Jan 2017 15:11:25 GMT

It's a basic certificate aquired from Digicert.com. When I look at the certificate itself, it says its RSA SHA256, 2048-bit. But I don't see where it says the encryption algorithm, though (like AES-128CBC or AES-256GCM). I will ask the CA vendor

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

kdd — Mon, 09 Jan 2017 14:02:26 GMT

please check that the digicert-certificate is among the certificate authorities. this is necessary for trusted relationship and this to decrypt.

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

kdd — Mon, 09 Jan 2017 14:07:40 GMT

take a look on the picture i think it is the DHE or ECDHE. Both are support but not for the inbound direction. Just for SSL Forward Proxy.

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

kdd — Mon, 09 Jan 2017 14:16:07 GMT

Both algorithms (DHE and ECDHE) are only support for SSL Forward Proxy. Not for inbound direction. Take a look at the photo.

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

Maxstr — Mon, 09 Jan 2017 14:44:17 GMT

The certificate is RSA,not DHE. However, noticed that there is an Digicert intermediary certificate in the chain. Do I need to load the intermediary into the PA? I obviously don't have their private key

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

kdd — Mon, 09 Jan 2017 15:36:06 GMT

Hi Max,

in our PA's certficate-memory are only root-certificates. two or three of them i imported to get sites decrypted. Because they weren't implicit. Do you have the root-CA as well? The intermediate will be used to issue the certificate for an aplicant. The Root-CA ensures the reliabilty of the intermediate cert. I think, you have to have der Root-CA as well.

To get a DigiCert Trusted Root Authority Certificates look here digicert .

Regards,

Klaus

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

Maxstr — Mon, 09 Jan 2017 16:44:39 GMT

Interesting, so I've added the root CA and intermediary CA, and now it shows the server's certificate under the other two. I thought that would fix the issue since it all lined up nicely, but no dice... I'm still getting the errors (first "decrypt-error" then "decrypt-param-unsupport").

So just to verify, the rule should be untrust to trust, source any, destination [the public IP of the server]?

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

RahmanDuran — Tue, 10 Jan 2017 09:36:54 GMT

No it won't work, PANOS does not support DHE and ECDHE ciphers for inbound ssl decryption. It does not have anything to do with your certificate. It is about the client and the webserver. Just run wireshark on your client and filter for server ip and ssl.handshake.type == 2. If you see that the client and server agreed on a DHE or ECDHE cipher, then inbound decryption will not work. You need to disable DHE and ECDHE ciphers on your web server so clients can not connect to server using DHE and ECDHE ciphers. Instead they will agree and use on other supported ciphers.

Rahman

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

kdd — Tue, 10 Jan 2017 10:02:57 GMT

it is right that DHE and ECDHE is not supported by PA for ssl-inbound-inspection. There ist a note in the Config which point to that. therefore you have to disable these algorithms like Rahman mentioned.

you will find the algorithms below Objects - Decryption Profil. DHE and ECDHE is checked but they will be used only for ssl forward proxy.

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

Maxstr — Tue, 10 Jan 2017 14:10:58 GMT

Oh, I see what you mean. I should create a new profile with only RSA checked.

So does that also mean I need to disable those ciphers on the web server? Or does the PA negotiate the protocol on its behalf?

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

kdd — Tue, 10 Jan 2017 15:31:53 GMT

yes, because thats what the server offers and i guess right now your server offers more than PA can decrypt. By the way the certificate of the root CA is only needed for ssl-forward-proxy. But thats the other direction.

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

Maxstr — Tue, 10 Jan 2017 16:09:21 GMT

Ok, I think I understand now. The documentation mentions none of this information 😕

So I ran the Qualsys SSL Labs test on my webserver, and it shows the server's "preffered order" of cipher suites. Sure enough, ECDHE is on the top, with RSA below it. Which means that browsers are negotiating ECDHE with the server, and the PA can't decrypt it.

I suppose I could remove ECDHE from the server's cipher list (by registry or the IISCrypto tool). I'm not familiar enough with the different cipher suites to know if there is anything inherently insecure with RSA compared to ECDHE. It might not even be PCI or FIPS compliant.

Thanks for all the assistance. It looks like inbound-decrypt is intended for some other use cases, not so much for web servers.

Re: "decrypt-unsupport-param" error on Inbound SSL Decryption

clewis1 — Tue, 10 Jan 2017 18:12:42 GMT

I suggest everyone to ask your SE to submit a feature request of being able to decrypt these ciphers inbound. Not decrypting SMTP and webservers is a big miss. I have had our SE vote in favor of this feature.