SSL decryption issue for Windows Store

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

SSL decryption issue for Windows Store

L4 Transporter

Hello,

 

After enabling SSL Decryption, we cannot download from Windows store. Getting error below.

Tried excluding hostname with Microsoft but no luck. How to fix this issue?

 

Error-windows-store.jpgexclude-store-list-decrypt.JPG

 

 

Thanks in advance.

1 accepted solution

Accepted Solutions

L7 Applicator

I am not sure if these are still all required exceptions but it is worth a try:

Screenshot_20180504-175517.jpg

View solution in original post

14 REPLIES 14

L7 Applicator

I am not sure if these are still all required exceptions but it is worth a try:

Screenshot_20180504-175517.jpg

L1 Bithead

fe3cr.delivery.mp.microsoft.com  is another.

what is the reason we need to allow all the hosts?

if we allow *.microsoft.com why does it not work then?

Curious to know the reason behind this?

MP

Help the community: Like helpful comments and mark solutions.

We (PA support) tested *.microsoft.com in url category and a policy.  That did not work.

We then added *.microsoft.com to the ssl decryption exception list.  Still no joy.

We then added the specific fe3cr.delivery.mp.microsoft.com url.  And Success.

L7 Applicator

@MP18 this is actually a goos question. From my side I can only say, that I did not test with *.microsoft.com as the requirement was to configure exceptions as accurate as possible.

 

Unfortunetely with these exact URLs there is the downside that - as we found out - they change with (not all) new microsoft versions of windows 10.

I have seen this behaviour with other websites where fix for us was to exempt  the source IP for decryption.

Seems *.url does not work in ssl exclusion  list.

 

This was not with single urls many urls and end devices were servers in data centre.

MP

Help the community: Like helpful comments and mark solutions.

Hello there,

Would you mind to tell me the fix for the same if there is any changed recently to the same url. As I am being reported continuously for the store problem as you mentioned.

I will be waiting for your reply.

thanks

Hi @TahirA 

 

We created the Decryption policy based on Source IP as exclusion list was not working on our PAN OS 8.1.9.

I do not know if PA has fixed this in newer PAN OS version.

 

Regards

MP

Help the community: Like helpful comments and mark solutions.

L0 Member

I just ran into this same issue and came across this thread.  Instead of just adding all of the FQDNs listed in the accepted solution, I took a packet capture and found connections to both of these FQDNS were having issues :

 

  • fe2cr.update.microsoft.com
  • fe3cr.delivery.mp.microsoft.com

I added the following wildcard FQDNs, which resolved the issue:

  • *.update.microsoft.com
  • *.delivery.mp.microsoft.com

Of course this could change in the future, but hopefully this helps someone.

Adding those two wildcards to a no-decrypt policy took care of it for me as well. Thanks @ericlwright!

 

 

Can you share your PCAP experience-wm?

 

 

 

 

HI Ericlwright

 

I added these two URLs to the SSL Decryption exceptions but still not working. any work around plz?

 


Thank you

I've had similar issues with AWS and facebook CDN sites and exemption doesn't seem to work properly. I am on 9.1.1 right now. Planning on bumping up to 10.0.4 to see whether the new decryption logging can help out troubleshooting this.

 

That's because the entry you listed will allow only a single-level sub-domain. A wildcard that would allow subdomains of that URL, in this case, would be *.delivery.mp.microsoft.com

  • 1 accepted solution
  • 15361 Views
  • 14 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!