General TLS protocol Error

[Salathiwe]

We have forward proxy (ssl decryption configured)

We are having intermittent access to some webpages users have to reload the page to gain access.
We are seeing General TLS Error on the decryption logs under Error.

What Iv found out about the error is that  

This message indicates that an error doesn't meet the criteria for any of the aforementioned protocol errors

[BPry]

@Salathiwe,

Unfortunately that particular error message doesn't give you much to go off of from a troubleshooting aspect. The best step forward is taking a PCAP and look through to validate that everything looks good from the logs as far as what the server is exchanging and what the firewall itself actually supports.

[MP18]

@Salathiwe Normally this means that Server only supports TLS1.3

This is what i have seen so far. Make sure on Firewall Decryption Profile - TLS version - TLS1.3 is selected.

Regards

[Salathiwe]

Thank will look into that

[Adrian_Jensen]

In addition, when debugging SSL decrypt problems I also recommend running SSLLabs "Test Your Server" on the endpoint server.  I have come across quite a few TLS/1.2 and 1.3 capable public servers that deliberately choose weak encryption algorithms for TLS/1.2 (server side prefers weak ciphers before strong). After successful TLS/1.2 negotiation the server then tries to upgrade the connection to HTTP/2.0, which explicitly forbids weak ciphers, causing the TLS/1.2 to abort. When doing a TLS/1.3 connection everything works fine as 1.3 requires strong ciphers to start. So the server is actually causing the problem, not the PaloAlto.