topic Re: SSL Decryption: SHA1-Intermediate certificate gets decrypted, even if not allowed to in General Topics

SSL Decryption: SHA1-Intermediate certificate gets decrypted, even if not allowed to

mrkskhn — Mon, 30 Dec 2019 13:22:14 GMT

Hi paloalto community,

I tested my new ssl decryption rules against the badssl dashboard ( https://badssl.com/dashboard/ ).

So far it looks good. Unfortunately the check for sha1-intermediate doesn’t pass. Our PA-850 (Firmware 9.0.5) does create a secure connection to this site for the client ( https://sha1-intermediate.badssl.com/ ), even I configured to not support SHA1.

Here is my configuration:

Is there something I forgot to configure?

Thanks and best regards,

Markus

Re: SSL Decryption: SHA1-Intermediate certificate gets decrypted, even if not allowed to

jdelio — Tue, 31 Dec 2019 23:11:43 GMT

This is odd that it would be happening with PAN-OS 9.0.5. As anything like that should have been cleared up.

There was a prior discussion talking about similar things:

https://live.paloaltonetworks.com/t5/General-Topics/PA-3020-SSL-Decryption-Query/m-p/280993#M75902

But there is no real answer as to why..

What browsers? does it matter if you use Edge, Firefox or Chrome?

Re: SSL Decryption: SHA1-Intermediate certificate gets decrypted, even if not allowed to

mrkskhn — Mon, 06 Jan 2020 08:36:47 GMT

Same with different browsers

Re: SSL Decryption: SHA1-Intermediate certificate gets decrypted, even if not allowed to

mrkskhn — Wed, 15 Jan 2020 16:14:12 GMT

Some more trouble with decryption:

https://www.lobster.de/

This page gets an untrusted paloalto cert, even it's a valid certificate? Can someone confirm this on his paloalto decryption setup?

Re: SSL Decryption: SHA1-Intermediate certificate gets decrypted, even if not allowed to

Remo — Wed, 15 Jan 2020 17:08:40 GMT

Hi @mrkskhn

At least this website is configured not correctly. The webserver does not send the intemediate certificate in the TLS handshake. Without this intermediate certificate the firewall cannot verify if this certificate is trusted / it is not able to check the certificate path.

You have not 3 possibilities with your current configuration:

Import the intermediate cert of this website manually onto your firewall and mark it as trusted root
Create a decryption rule with another decryption profile where you allow untrusted issuers and add a custom URL category to that rule where you add websites like this one
Try to contact the operator of the website to have them fix the issue

And yes, because paloalto firewalls don't have the intermediate certs locally the "problem" you see will be on all palo fws.