topic PAN shows fatal ssl handshake failure in General Topics

https://www.google.com does not work on 4.0.10

mhuels — Tue, 24 Apr 2012 16:08:45 GMT

there seems to be a problem with ssl connect from PA to google.

The browsers shows a timeout. It takes a couple of minutes, until i get an entry in my logfile.

The logfile shows an "unknown application" first (which is denied in my company by default) and thereafter pretendedly a working "ssl" and "web-browsing" application, as you can see in the attached picture.

I assume a problem with the kind of certificate, which is used by google.

PAN shows fatal ssl handshake failure

mhuels — Wed, 25 Apr 2012 10:55:03 GMT

65568 2012-04-25 12:33:24.903639 1.2.3.4 209.85.147.94 TLSv1 [TCP Retransmission] Alert (Level: Fatal, Description: Handshake Failure)

65597 2012-04-25 12:33:24.926864 209.85.147.94 1.2.3.4 TCP https > 54361 [RST] Seq=1 Win=0 Len=0

this happens - as far as i know - only with google.com, respectively google.de, on which we will transmitted by google.com

mfg

Manfred

perhaps PAN has a problem with the SSL Extensions from google

mhuels — Wed, 25 Apr 2012 11:39:39 GMT

i suppose PAN has a problem with theSSL Extensions from google

Extension (id-ce-subjectAltName)
                                Extension Id: 2.5.29.17 (id-ce-subjectAltName)
                                GeneralNames: 436 items
                                    GeneralName: dNSName (2)
                                        dNSName: google.com
                                    GeneralName: dNSName (2)
                                        dNSName: *.google.com
                                    GeneralName: dNSName (2)
                                        dNSName: *.google.ac
                                    GeneralName: dNSName (2)
                                        dNSName: *.google.ad
                                    GeneralName: dNSName (2)
                                        dNSName: *.google.ae

.....

Re: perhaps PAN has a problem with the SSL Extensions from google

essnet — Wed, 25 Apr 2012 12:09:17 GMT

Hello,

With 4.1.5 it's all good here. We are using Gapps worldwide without any problem and SSL decryption is activated.