topic Re: SSL Decryption every day more exclusions in General Topics

SSL Decryption every day more exclusions

ZEBIT — Mon, 08 Jun 2020 06:37:14 GMT

Hi,

We are using a PaloAlto 3260 with PanOS 9.0.7. We have configured SSL decryption wich uses a certificate signed by our own Windows CA server. Each client in our environment has the Windows Root CA.

In the beginning (2 years ago) everything worked well. We could decrypt everything except everything in the category financial.

But now latest months it seems I need to add a lot of websites for no decryption because otherwise the employees can't visit the website. It is getting frustrated and I'm think about disabling SSL decryption, but maybe you guys know an answer or solution.

Thanks.

Re: SSL Decryption every day more exclusions

kiwi — Mon, 08 Jun 2020 09:47:36 GMT

Hi @ZEBIT ,

I would advise against disabling SSL decryption entirely.

Instead of just adding them to the no decrypt policy try figuring out why users are experiencing issues with those sites.

Are you blocking access on some of the verifications (unsupported ciphers, versions, certificate issues, ... ) ?

Cheers,

-Kiwi

Re: SSL Decryption every day more exclusions

ZEBIT — Mon, 08 Jun 2020 10:13:16 GMT

Hi @kiwi

I think I'm quit soft (too soft) in my policy. Here you can see screenshots of the whole policy + certficats like our partner implemented.

Re: SSL Decryption every day more exclusions

rmfalconer — Wed, 10 Jun 2020 16:50:02 GMT

There are an increasing number of sites that use techniques that block SSL decryption. As an example, SSL pinning is used to block MITM attacks so it will keep you from accessing a site that uses it when SSL decrypt is enabled.

The PA has a large default list of excluded sites, located in Device-Certificate Management-SSL Decryption Exclusion. We've had to add a fair number of sites to this list, including a few of the Microsoft online offerings.

I would agree that you shouldn't disable decryption globally, you'll just have to keep on top of creating exclusions when needed. I think you should also review your current policies. As you say, they are pretty soft.