10-31-2016 04:59 AM
Hi,
I've implemented SSL Decryption in our environment and it worked find for most of the domains but "sometimes" when we access Gmail using Chrome it will give us a certificate error.
We are using internal CA and the Root certificate was distributed to all machines using GPO. I checked the trusted CA on Chrome and the certificate was there, deleted it and imported it manually and still the same error. Using IE, gmail is accessible but really slow.
When I stop SSL Decryption policy gmail is accessible.
No URLs were specified in the URL tab of the policy.
Is this behavior might be because we implemented User-ID recently? Mapping still not stable and we are getting some sources as Unknown.
Kindly let me know if you have any ideas.
11-03-2016 03:31 AM
Hi All,
Thanks for the effort guys, really appreciate it.
The issue was quic application, a simple deny rule for quick app-id solved the problem.
Resolved by the below URL:
https://live.paloaltonetworks.com/t5/Management-Articles/Blocking-QUIC-Protocol/ta-p/120207
Regards,
Sharief
10-31-2016 05:18 AM - edited 10-31-2016 05:19 AM
Update:
-Chrome has been updated to latest version.
-Reset the certificate cache using:
debug dataplane reset ssl-decrypt certificate-cache
Still the same issue.
10-31-2016 06:03 AM
Does it give a certificate error in other browsers, firefox, IE, etc. and whats the message from the certificate error?
Regards,
Conan
10-31-2016 06:28 AM
No, only in Chrome and only when accessing Gmail.
The error message is "your connection is not secure".
10-31-2016 08:17 AM
Just want to double check this is Chrome, "Your connection is not secure!" is a Firefox error message, Chrome would be "Your connection is not private!".
Article below would explain this if it's Firefox.
- https://live.paloaltonetworks.com/t5/Configuration-Articles/After-Configuring-SSL-Decryption-Mozilla...
-Conan
10-31-2016 10:22 AM
When users get the "not secure" message are they able to proceed and accept the risk or are they prevented from continuing on?
If they're not allowed to continue on can you confirm that you aren't using a SHA1 signed cert? Newer versions of Chrome do not support SHA1 certs any longer. I think about a month ago now, maybe a bit longer.
11-03-2016 03:31 AM
Hi All,
Thanks for the effort guys, really appreciate it.
The issue was quic application, a simple deny rule for quick app-id solved the problem.
Resolved by the below URL:
https://live.paloaltonetworks.com/t5/Management-Articles/Blocking-QUIC-Protocol/ta-p/120207
Regards,
Sharief
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
