Certificate error when accessing Gmail using SSL Decryption

cancel
Showing results for 
Search instead for 
Did you mean: 

Certificate error when accessing Gmail using SSL Decryption

L4 Transporter

Hi,

 

I've implemented SSL Decryption in our environment and it worked find for most of the domains but "sometimes" when we access Gmail using Chrome it will give us a certificate error.

 

We are using internal CA and the Root certificate was distributed to all machines using GPO. I checked the trusted CA on Chrome and the certificate was there, deleted it and imported it manually and still the same error. Using IE, gmail is accessible but really slow.

 

When I stop SSL Decryption policy gmail is accessible.

 

No URLs were specified in the URL tab of the policy.

 

Is this behavior might be because we implemented User-ID recently? Mapping still not stable and we are getting some sources as Unknown.

 

Kindly let me know if you have any ideas.

Regards,
Sharief
1 ACCEPTED SOLUTION

Accepted Solutions

Hi All,

 

Thanks for the effort guys, really appreciate it.

 

The issue was quic application, a simple deny rule for quick app-id solved the problem.

 

Resolved by the below URL:

 

https://live.paloaltonetworks.com/t5/Management-Articles/Blocking-QUIC-Protocol/ta-p/120207

 

Regards,

Sharief

Regards,
Sharief

View solution in original post

6 REPLIES 6

L4 Transporter

Update:

-Chrome has been updated to latest version.

-Reset the certificate cache using:

debug dataplane reset ssl-decrypt certificate-cache

 

Still the same issue.

Regards,
Sharief

Does it give a certificate error in other browsers, firefox, IE, etc. and whats the message from the certificate error?

Regards,
Conan

No, only in Chrome and only when accessing Gmail.

The error message is "your connection is not secure".

Regards,
Sharief

Just want to double check this is Chrome, "Your connection is not secure!" is a Firefox error message, Chrome would be "Your connection is not private!".
Article below would explain this if it's Firefox.
- https://live.paloaltonetworks.com/t5/Configuration-Articles/After-Configuring-SSL-Decryption-Mozilla...

-Conan

Cyber Elite
Cyber Elite

When users get the "not secure" message are they able to proceed and accept the risk or are they prevented from continuing on?

 

If they're not allowed to continue on can you confirm that you aren't using a SHA1 signed cert?  Newer versions of Chrome do not support SHA1 certs any longer.  I think about a month ago now, maybe a bit longer.

Hi All,

 

Thanks for the effort guys, really appreciate it.

 

The issue was quic application, a simple deny rule for quick app-id solved the problem.

 

Resolved by the below URL:

 

https://live.paloaltonetworks.com/t5/Management-Articles/Blocking-QUIC-Protocol/ta-p/120207

 

Regards,

Sharief

Regards,
Sharief

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!