topic Re: SSL decryption issue for Windows Store in General Topics

SSL decryption issue for Windows Store

Farzana — Fri, 04 May 2018 06:45:01 GMT

Hello,

After enabling SSL Decryption, we cannot download from Windows store. Getting error below.

Tried excluding hostname with Microsoft but no luck. How to fix this issue?

Thanks in advance.

Re: SSL decryption issue for Windows Store

Remo — Fri, 04 May 2018 15:58:02 GMT

I am not sure if these are still all required exceptions but it is worth a try:

Re: SSL decryption issue for Windows Store

Timotheous — Mon, 16 Dec 2019 21:21:24 GMT

fe3cr.delivery.mp.microsoft.com is another.

Re: SSL decryption issue for Windows Store

MP18 — Tue, 17 Dec 2019 05:20:38 GMT

what is the reason we need to allow all the hosts?

if we allow *.microsoft.com why does it not work then?

Curious to know the reason behind this?

Re: SSL decryption issue for Windows Store

Timotheous — Tue, 17 Dec 2019 17:23:26 GMT

We (PA support) tested *.microsoft.com in url category and a policy. That did not work.

We then added *.microsoft.com to the ssl decryption exception list. Still no joy.

We then added the specific fe3cr.delivery.mp.microsoft.com url. And Success.

Re: SSL decryption issue for Windows Store

Remo — Tue, 17 Dec 2019 19:32:49 GMT

@MP18 this is actually a goos question. From my side I can only say, that I did not test with *.microsoft.com as the requirement was to configure exceptions as accurate as possible.

Unfortunetely with these exact URLs there is the downside that - as we found out - they change with (not all) new microsoft versions of windows 10.

Re: SSL decryption issue for Windows Store

MP18 — Wed, 18 Dec 2019 04:54:58 GMT

I have seen this behaviour with other websites where fix for us was to exempt the source IP for decryption.

Seems *.url does not work in ssl exclusion list.

This was not with single urls many urls and end devices were servers in data centre.

Re: SSL decryption issue for Windows Store

TahirA — Mon, 14 Sep 2020 07:07:27 GMT

Hello there,

Would you mind to tell me the fix for the same if there is any changed recently to the same url. As I am being reported continuously for the store problem as you mentioned.

I will be waiting for your reply.

thanks

Re: SSL decryption issue for Windows Store

MP18 — Tue, 15 Sep 2020 13:35:58 GMT

Hi @TahirA

We created the Decryption policy based on Source IP as exclusion list was not working on our PAN OS 8.1.9.

I do not know if PA has fixed this in newer PAN OS version.

Regards

Re: SSL decryption issue for Windows Store

ericlwright — Fri, 23 Oct 2020 16:12:06 GMT

I just ran into this same issue and came across this thread. Instead of just adding all of the FQDNs listed in the accepted solution, I took a packet capture and found connections to both of these FQDNS were having issues :

fe2cr.update.microsoft.com
fe3cr.delivery.mp.microsoft.com

I added the following wildcard FQDNs, which resolved the issue:

*.update.microsoft.com
*.delivery.mp.microsoft.com

Of course this could change in the future, but hopefully this helps someone.

Re: SSL decryption issue for Windows Store

magates — Fri, 23 Oct 2020 17:32:23 GMT

Adding those two wildcards to a no-decrypt policy took care of it for me as well. Thanks @ericlwright!

Re: SSL decryption issue for Windows Store

TahirA — Fri, 23 Oct 2020 18:37:16 GMT

Can you share your PCAP experience-wm?

Re: SSL decryption issue for Windows Store

TahirA — Mon, 26 Oct 2020 12:54:51 GMT

HI Ericlwright

I added these two URLs to the SSL Decryption exceptions but still not working. any work around plz?

Thank you

Re: SSL decryption issue for Windows Store

J_Wesolowski — Tue, 15 Dec 2020 19:59:22 GMT

I've had similar issues with AWS and facebook CDN sites and exemption doesn't seem to work properly. I am on 9.1.1 right now. Planning on bumping up to 10.0.4 to see whether the new decryption logging can help out troubleshooting this.

Re: SSL decryption issue for Windows Store

prusiecki — Wed, 12 May 2021 14:35:45 GMT

That's because the entry you listed will allow only a single-level sub-domain. A wildcard that would allow subdomains of that URL, in this case, would be *.delivery.mp.microsoft.com