topic Re: Decryption policy and SNI in General Topics

Decryption policy and SNI

s_quasar — Tue, 22 Jan 2019 22:35:37 GMT

Hi,

I activated a decyption policy but my site is configured with SNI. If I apply the policy, the other site with the same IP is blocked with error SSL_ERROR_NO_CYPEHR_OVERLAP (this in Firefox). Which is the correct configuration with SNI?

Re: Decryption policy and SNI

BPry — Tue, 22 Jan 2019 22:54:00 GMT

@s_quasar,

In the Firefox configuration can you look for 'security.tls.version.fallback-limit' and set the value to 0 and see if you can access the site after that?

Re: Decryption policy and SNI

s_quasar — Tue, 22 Jan 2019 23:06:40 GMT

Now I've stopped the rule so I can't do this test but I think this is not a solution because I can't open the firefox configuration of all people to make this change.

Re: Decryption policy and SNI

BPry — Tue, 22 Jan 2019 23:15:04 GMT

@s_quasar,

It's a simple test to see if my theory of what is happening is actually correct, it's not the solution that you would actually employ.

Re: Decryption policy and SNI

s_quasar — Wed, 23 Jan 2019 09:28:09 GMT

I've made the change but the problem is the same: SSL_ERROR_NO_CYPHER_OVERLAP. The error in chrome is ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

Re: Decryption policy and SNI

s_quasar — Fri, 25 Jan 2019 07:23:01 GMT

Is there someone that can help me?

Re: Decryption policy and SNI

Ilya_Kuranov — Thu, 18 Apr 2019 08:27:29 GMT

Hello, @s_quasar

if your problem is still actual - try to check this thread:

https://live.paloaltonetworks.com/t5/General-Topics/Decrypt-error-with-Inbound-Decryption-DHE-or-ECDHE-on-8-1-3/td-p/248768/page/2

Maybe your problem is related to it

Re: Decryption policy and SNI

s_quasar — Thu, 17 Oct 2019 13:59:49 GMT

Hi,

my problem is yet here.

Thank you for your help but this is not my case. I have problem on decrypt only if I have a website that share the same IP (SNI).

Re: Decryption policy and SNI

s_quasar — Tue, 22 Oct 2019 10:17:54 GMT

Is there anyone that works decrypt in the presence of SNI?

Can I have an example about decryption with SNI?