SSL Forward Proxy Edge Browser problems

Reply
L1 Bithead

SSL Forward Proxy Edge Browser problems

Hello,

We have a problem at one of our new locations with the Edge Browser when using SSL Forward Proxy (PA-220).

The problem is as following: When we activate the SSL Forward Proxy, the Edge browser takes very long and sometimes even disconnects when trying to open a normal webpage with TLS. Chrome, Mozilla & Internet explorer are OK. Certificates are also trusted and there are no GPO rules for the Edge browser which could cause problems.

 

I made a packet capture and noticed following: The server key exchange packet comes in, and then the client takes a long time to respond with the client key exchange (~10seconds). Does anybody have an idea what could cause there a problem? As I wrote, other browsers are OK.

grafik.png

Thanks and regards

L4 Transporter

Re: SSL Forward Proxy Edge Browser problems

What Decryption Profile options do you have enabled on the Policy? 

L1 Bithead

Re: SSL Forward Proxy Edge Browser problems

Only default values are enabled:

grafik.png

I tested today again and the internet explorer is also affected. Chrome is OK. Seems like Microsoft Browsers have some problems with it.

Highlighted
L1 Bithead

Re: SSL Forward Proxy Edge Browser problems

After some more troubleshooting we (my collegue :) ) found the cause for the problem:

The forward-trust certificate name was a hostname which the Firewall could resolve from external. The FW then tried to verify the CRL, but as the FW resolved it to an external address, the verification could not happen as the CRL verification should happen internally. After creating a new forward trust cert with a random name, the decryption was running smoothly.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!