Decryption policy and SNI

[s_quasar]

Hi,

I activated a decyption policy but my site is configured with SNI. If I apply the policy, the other site with the same IP is blocked with error SSL_ERROR_NO_CYPEHR_OVERLAP (this in Firefox). Which is the correct configuration with SNI?

[BPry]

@s_quasar,

In the Firefox configuration can you look for 'security.tls.version.fallback-limit' and set the value to 0 and see if you can access the site after that?

[s_quasar]

Now I've stopped the rule so I can't do this test but I think this is not a solution because I can't open the firefox configuration of all people to make this change.

[BPry]

@s_quasar,

It's a simple test to see if my theory of what is happening is actually correct, it's not the solution that you would actually employ. 

[s_quasar]

I've made the change but the problem is the same: SSL_ERROR_NO_CYPHER_OVERLAP. The error in chrome is ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

[s_quasar]

Is there someone that can help me?

[Ilya_Kuranov]

Hello, @s_quasar 

if your problem is still actual - try to check this thread:

https://live.paloaltonetworks.com/t5/General-Topics/Decrypt-error-with-Inbound-Decryption-DHE-or-ECD...

Maybe your problem is related to it

[s_quasar]

Hi,

my problem is yet here.

Thank you for your help but this is not my case. I have problem on decrypt only if I have a website that share the same IP (SNI).

[s_quasar]

Is there anyone that works decrypt in the presence of SNI?

Can I have an example about decryption with SNI?