topic Re: decrypt-cert-validation while performing windows update in General Topics

decrypt-cert-validation while performing windows update

khanshahidnazir — Wed, 11 Sep 2019 12:42:18 GMT

Hey Guys ... I am doing a normal Windows Update and i am getting error.

While analysing the application type is ms-update and reason for session end is decrypt-cert-validation.

Appreciate if you guys can support.

Re: decrypt-cert-validation while performing windows update

myky — Wed, 11 Sep 2019 14:03:56 GMT

FYI:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boONCAY

Re: decrypt-cert-validation while performing windows update

OtakarKlier — Wed, 11 Sep 2019 16:15:12 GMT

Hello,

Dont decrypt Microsoft updates. We have a no decrypt policy just for it.

Regards,

Re: decrypt-cert-validation while performing windows update

Sec101 — Wed, 11 Sep 2019 16:36:13 GMT

@OtakarKlier

What does that no decrypt policy look like? You can't do no decrypt by application right? Thinking you have a destination list, or list of URL's you are triggering the no decrypt on?

Re: decrypt-cert-validation while performing windows update

OtakarKlier — Wed, 11 Sep 2019 16:43:05 GMT

Hello,

Sorry for not clarifying earlier. A no decrypt policy is just a decryption policy with the action set to 'no-decrypt'. We use this for URL's and URL categories.

Regards,

Re: decrypt-cert-validation while performing windows update

Sec101 — Thu, 12 Sep 2019 20:57:20 GMT

Did you add those directly to your No decrypt policy, or where is that list getting populated from? - Just asking in reference to where the actual second screenshot resides on your firewall. Thank you for the quick reply!

Re: decrypt-cert-validation while performing windows update

OtakarKlier — Thu, 12 Sep 2019 21:07:42 GMT

Hello,

Its a list we came up with when googling. Here is one just for wsus:

https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus

https://kc.mcafee.com/corporate/index?page=content&id=KB88947&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US

The main issue we face at times is taht the update will fail since the firewall is blocking something. This is mainly due to the backend IP's and DNS changing at a faster rate than the PAN does. Not a knock against PAN, its just the backend MS Updates change and are not all documented.

Regards,

Re: decrypt-cert-validation while performing windows update

khanshahidnazir — Mon, 16 Sep 2019 08:17:10 GMT

Greetings ...

Thanks a lot for your inputs and suggestions.

I followed your screenshot and added all URL's but i am still not able to update windows.

I am also sharing my Decryption Profile screenshot.

Re: decrypt-cert-validation while performing windows update

charlesk — Wed, 06 Nov 2019 18:14:11 GMT

@khanshahidnazir We are also experiencing this. We have found that MS Store will intermittently update and download, but the full blown WIN10 updates don't work.

We are using a custom URL Category pushed from the panorama to populate a decryption bypass list of addresses that will not get decrypted. We are seeing this manifest in the logs with a session end reason of: decrypt-cert-validation. Is that what you were seeing?

Re: decrypt-cert-validation while performing windows update

khanshahidnazir — Thu, 07 Nov 2019 07:46:03 GMT

Greetings ...

Yes we are also seeing this.

Re: decrypt-cert-validation while performing windows update

OtakarKlier — Thu, 07 Nov 2019 17:11:45 GMT

Hello,

If these are windows 10 1903 systems and use the distributed model for updates. You'll need to add the following to your whitelist to allow and not decrypt these domains:

•*.do.dsp.mp.microsoft.com
*.delivery.mp.microsoft.com
*.prod.do.dsp.mp.microsoft.com

https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1903-endpoints

Regards,

Re: decrypt-cert-validation while performing windows update

charlesk — Thu, 07 Nov 2019 17:46:16 GMT

We already have the *.mp.microsoft.com whitelisted and have for some time.

Re: decrypt-cert-validation while performing windows update

OtakarKlier — Thu, 07 Nov 2019 18:11:34 GMT

Hello,

So did we and it was getting blocked. That is why we had to add the additional domains I listed previously :(.

Regards,