topic SSL Inbound decryption -Decryption error in General Topics

SSL Inbound decryption -Decryption error

Joshan_Lakhani — Thu, 12 Mar 2020 07:18:23 GMT

One of my application is not decrypted i have applied SSL inbound decryption policy and got decryption-error.

On other hand another application with same intermediate certificate having decrypted. As same intermediate only child certificate is change.

Re: SSL Inbound decryption -Decryption error

jdelio — Thu, 12 Mar 2020 19:05:38 GMT

It is near impossible to answer any speculative issues without logs showing details..

Looking at past cases, this issue is normally caused by an incomplete certificate chain.

Normally, the workaround for this particular issue to import the entire chain as one bundle. Please follow the document:- https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Install-a-Chained-Certificate-Signed-by-a-Public-CA/ta-p/55523

I hope this helps.

Re: SSL Inbound decryption -Decryption error

Joshan_Lakhani — Thu, 12 Mar 2020 19:19:43 GMT

Certificate chain is also complete intermediate and parent certificate all are complete i have received this already when i apply decryption.

traffic is generating an error message - ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cipher suite mismatch Firewall and server).

Re: SSL Inbound decryption -Decryption error

robmaas — Thu, 16 Mar 2023 10:50:42 GMT

Sorry for the bump, but it might help others.

I stumbled upon the exact same problem, the problem in this case was that the certificate/key were automatically renewed on the server. This is quite common when using Let's Encrypt with ACME (http-01 or dns-01) challenge.

When getting this error make sure to check if this is the case.

In these cases it makes sense to automate the renewal of the certificates on the firewall with the API, as an example.

curl -k -X POST -F "file=@server.key" "https://1.2.3.4/api/?key=xxx&type=import&category=private-key&certificate-name=server.com&format=pem&passphrase=xxx"

curl -k -X POST -F "file=@server.crt" "https://1.2.3.4/api/?key=xxx&type=import&category=certificate&certificate-name=server.com&format=pem"