topic Re: SSL Decryption issue (wrong certificate) in General Topics

SSL Decryption issue (wrong certificate)

TranceforLife — Mon, 06 Feb 2017 19:05:25 GMT

Hi All,

Having SSL Decryption issue with one of the websites at the moment (https://wiki.freeradius.org/Home)

So testing without decryption and checking certs chain:

Can see root CA on Palo:

So all looks good. Implementing SSL Decryption (test version only) with two certs generated on PA one for forward trust another is for forward untrust:

Doing a test with some websites reviewing a forward trust cert. As an example bbc.co.uk:

l didn't import cert to the test PC as want to confirm first everything is working fine.

Done another test with the websites which allow decryption all looks good correct cert is forwarded. But for the website https://wiki.freeradius.org/Home getting the wrong cert which is forward untrust:

Don't know why. Cache is cleared, and the new cert is recreated for untrust but still the same.

PA-5050 Active/Active PAN-OS 7.1.5

Am l missing something simple?

Regards,

Myky

Re: SSL Decryption issue (wrong certificate)

Retired Member — Mon, 06 Feb 2017 19:09:29 GMT

Check the results there is your answer:

https://www.ssllabs.com/ssltest/analyze.html?d=wiki.freeradius.org&hideResults=on

Re: SSL Decryption issue (wrong certificate)

jvalentine — Mon, 06 Feb 2017 19:12:02 GMT

I'm not certain, but this might be caused by an incomplete certificate chain (per ssllabs.com):

The traffic log complains about cert-validation as well:

https://www.ssllabs.com/ssltest/analyze.html?d=wiki.freeradius.org

Re: SSL Decryption issue (wrong certificate)

TranceforLife — Mon, 06 Feb 2017 19:17:14 GMT

@jvalentine @Retired Member thanks all. Looks like l missing something simple. Why the web-browser is not complaining without ssl decryption in place?

Re: SSL Decryption issue (wrong certificate)

Retired Member — Mon, 06 Feb 2017 19:20:01 GMT

Its because you use IE.

IE wil try to dowload the missing certificates in the chain.

Try firefox and it will complain.

Re: SSL Decryption issue (wrong certificate)

TranceforLife — Mon, 06 Feb 2017 19:28:36 GMT

@Retired Member ok with firefox l am not even able to open this website. Chrome also is not complaining:

I am new to SSL so if you can let me know what is actually happening with the server cert l will appreciate:0

Thx,

Myky

Re: SSL Decryption issue (wrong certificate)

Retired Member — Mon, 06 Feb 2017 19:40:56 GMT

Its not a problem of the PA or your decryption settings.

The website certificate is incorrect configured, the intermediate certificates are missing.

Thats why the PA sends the "not trusted" certificate to your browser.

Re: SSL Decryption issue (wrong certificate)

TranceforLife — Mon, 06 Feb 2017 19:36:50 GMT

Hi @Retired Member

Ok cool as you said before IE and Chrome will ignore this, right? As long as it has a root CA.

Thx,

Myky

Re: SSL Decryption issue (wrong certificate)

Retired Member — Mon, 06 Feb 2017 19:40:34 GMT

Yes, Chrome(uses the windows cert store) and IE will try to download the intermediate certs as long as they have a valid root CA in their certificate store.

Re: SSL Decryption issue (wrong certificate)

TranceforLife — Mon, 06 Feb 2017 19:53:37 GMT

Cool l have learned something new today. Thanks/ Last thing Do you have any good article explaining this?

Thx,

Myky

Re: SSL Decryption issue (wrong certificate)

Retired Member — Mon, 06 Feb 2017 20:06:44 GMT

Your welcome.

I don't have documentation on this issue specific. ( its all in my head 😉 )

Re: SSL Decryption issue (wrong certificate)

TranceforLife — Tue, 07 Feb 2017 13:26:10 GMT

To fix the issue for this particular website l did import a COMODORSADomainValidationSecureServerCA.crt to the box:

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Import-the-Intermediate-CA-on-the-Firewall/ta-p/52196

Re: SSL Decryption issue (wrong certificate)

Retired Member — Tue, 07 Feb 2017 13:53:09 GMT

In my opinion is importing the intermediate certificate in this situation wrong.

The behaviour was as expected and correct.

With this "fix", you are covering a warning that the site is misconfigured.

Re: SSL Decryption issue (wrong certificate)

TranceforLife — Tue, 07 Feb 2017 14:03:22 GMT

I do agree with you as really it is a "masquerading" of the problem.