TLS 1.3 is Coming - How to deal with it????

Reply
L4 Transporter

Re: TLS 1.3 is Coming - How to deal with it????

This message was sent to Palo Alto Networks customers:

 

Dear valued Palo Alto Networks customer,

 

Please take the action recommended below if you have enabled SSL decryption forward proxy. This is required for users to access Gmail and other websites and applications using web browsers that implement strict TLS 1.3 compliance. We have been informed that Google Chrome is planning to implement strict TLS 1.3 compliance in their upcoming version 72. The stable build of Google Chrome version 72 may be available in January 2019, and if your users use a pre-stable build of Google Chrome, they will experience the issue outlined below earlier.

 

Applies to

All supported PAN-OS releases

 

Action Required

If you run PAN-OS 8.1:

  • Upgrade to PAN-OS 8.1.4 (available now)

 

If you run a prior version of PAN-OS, plan to upgrade to one of the following releases:

  • PAN-OS 8.0.14 (targeted to be available on Nov 15, 2018*)
  • PAN-OS 7.1.21 (targeted to be available on Nov 1, 2018*)

 

Impact

Without upgrading to one of the above maintenance releases, users may no longer be able access Gmail and other websites and applications that utilize TLS 1.3 when SSL forward proxy decryption is in use. As a result, your users will receive the following web browser error: ‘ERR_TLS13_DOWNGRADE_DETECTED’.

 

By upgrading PAN-OS to one of the above maintenance releases, your users will be able to continue to access Gmail and other TLS 1.3 enabled websites and applications when using browsers that exhibit this behavior.

 

L6 Presenter

Re: TLS 1.3 is Coming - How to deal with it????


@bspilde wrote:

PAN-OS 8.0.14 and 8.1.4 will support TLS 1.3.

 

 


Thanks for following up.

L6 Presenter

Re: TLS 1.3 is Coming - How to deal with it????

@bspilde Where / How did you recieve this info below?

 

 


@bspilde wrote:

This message was sent to Palo Alto Networks customers:

 

Dear valued Palo Alto Networks customer,

 

Please take the action recommended below if you have enabled SSL decryption forward proxy. This is required for users to access Gmail and other websites and applications using web browsers that implement strict TLS 1.3 compliance. We have been informed that Google Chrome is planning to implement strict TLS 1.3 compliance in their upcoming version 72. The stable build of Google Chrome version 72 may be available in January 2019, and if your users use a pre-stable build of Google Chrome, they will experience the issue outlined below earlier.

 

Applies to

All supported PAN-OS releases

 

Action Required

If you run PAN-OS 8.1:

  • Upgrade to PAN-OS 8.1.4 (available now)

 

If you run a prior version of PAN-OS, plan to upgrade to one of the following releases:

  • PAN-OS 8.0.14 (targeted to be available on Nov 15, 2018*)
  • PAN-OS 7.1.21 (targeted to be available on Nov 1, 2018*)

 

Impact

Without upgrading to one of the above maintenance releases, users may no longer be able access Gmail and other websites and applications that utilize TLS 1.3 when SSL forward proxy decryption is in use. As a result, your users will receive the following web browser error: ‘ERR_TLS13_DOWNGRADE_DETECTED’.

 

By upgrading PAN-OS to one of the above maintenance releases, your users will be able to continue to access Gmail and other TLS 1.3 enabled websites and applications when using browsers that exhibit this behavior.

 


 

L4 Transporter

Re: TLS 1.3 is Coming - How to deal with it????

It was sent via email from noreply@paloaltonetworks.com on October 22nd. I’m not sure exactly what enrolled me in the message list.

On the support page check preferences under your profile for all communication preferences by type.

Hope that helps!
L1 Bithead

Re: TLS 1.3 is Coming - How to deal with it????

This issue had disappeared for us after upgrading our firewalls (now at 8.1.5). However, as of this morning (on Chrome 71.0.3578.98 and possibly older versions), it has reappeared for at least two URLs:

https://www.yegjoyride.com/volunteer-1

https://eschenker.dbschenker.com//nges-portal/public/en-US_US/#!/tracking/customer-search?refType=aa...

 

The first one is happy in Firefox; however, the second one has a similar error in Firefox. No errors occur from our guest network, which has no decryption.

Highlighted
L4 Transporter

Re: TLS 1.3 is Coming - How to deal with it????

Those URL's/categories are being decrypted?

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!