topic Re: SSL Forward Proxy Edge Browser problems in General Topics

SSL Forward Proxy Edge Browser problems

ErrantOsi — Tue, 20 Nov 2018 11:12:34 GMT

Hello,

We have a problem at one of our new locations with the Edge Browser when using SSL Forward Proxy (PA-220).

The problem is as following: When we activate the SSL Forward Proxy, the Edge browser takes very long and sometimes even disconnects when trying to open a normal webpage with TLS. Chrome, Mozilla & Internet explorer are OK. Certificates are also trusted and there are no GPO rules for the Edge browser which could cause problems.

I made a packet capture and noticed following: The server key exchange packet comes in, and then the client takes a long time to respond with the client key exchange (~10seconds). Does anybody have an idea what could cause there a problem? As I wrote, other browsers are OK.

Thanks and regards

Re: SSL Forward Proxy Edge Browser problems

mharding — Tue, 20 Nov 2018 14:58:40 GMT

What Decryption Profile options do you have enabled on the Policy?

Re: SSL Forward Proxy Edge Browser problems

ErrantOsi — Wed, 21 Nov 2018 16:00:26 GMT

Only default values are enabled:

I tested today again and the internet explorer is also affected. Chrome is OK. Seems like Microsoft Browsers have some problems with it.

Re: SSL Forward Proxy Edge Browser problems

ErrantOsi — Wed, 05 Dec 2018 14:41:09 GMT

After some more troubleshooting we (my collegue 🙂 ) found the cause for the problem:

The forward-trust certificate name was a hostname which the Firewall could resolve from external. The FW then tried to verify the CRL, but as the FW resolved it to an external address, the verification could not happen as the CRL verification should happen internally. After creating a new forward trust cert with a random name, the decryption was running smoothly.