Google disclaimer and SSL Decryption

[Laurent_Dormond]

Hello,

I have enabled SSL decryption on a PA-500 running PanOS 7.0.9 for testing purposes (before enabling in prod environment).

All seems to be working fine, except with the Google Disclaimer that randomly occurs and that you have to agree with in order to go ahead with your google searches...

Without SSL decryption it displays normally, but with SSL decryption enabled, it only displays a empty (white) frame and the end user can't agree and thus stucks on this page...

There is nothing denied or blocked by any PanOS feature, test policy is "any any allow".

This is occuring with IE 11 (not tested with another browser).

Does anymone ever experienced this issue ?

Regards,

Laurent

[Brandon_Wertz]

Not for me.

Running IE 11.0.9600

Maybe try a PCAP from the palo and see what's happening.  That's really only been my recourse when technical SSL issues like you're having.

[bbilut]

Sounds like maybe your SSL cert is not loaded on your computers as a "Trusted Root Certification Authority"

I decrypt all our Google traffic so I can enforce safe search, youtube safety-mode, and others. We don't have any problems in Chrome or IE, but Firefox has it's own certificate store and doesn't use Windows.

[Laurent_Dormond]

Hi Brad,

indeed, my ssl cert is not loaded as "Trusted Root CA cert", since it is just SSL decrypt test purposes.

Also I have the "untrusted issuer warning" message in the browser for each decrypted HTTPS website, but it is not a problem for the instance.

To add some more visual description of the problem, here are two screenshot with and without ssl decrpytion :

 Here with SSL decryption deactivated

 Here with SSL decryption enabled

[BPry · Accepted solution]

So I'm just going to take an educated guess here after seeing your screen but without your ssl decryption cert being trusted you would have to 'allow' the connection to continue. Since Google isn't pulling that resource from the same server (you can test this with the dev tools network monitoring) it isn't loading the resource because you haven't actually allowed that action to continue with the untrusted cert. If you add that cert into your trusted store then you should see this issue go away. 

[Laurent_Dormond]

Hi,

That sounds good indeed, I will try out and let you know the result.

I remember in the PCAP captures that there were a lots of SSL handshakes (client hello, server hello, ...) that probably means that there are multiple SSL connexions to different resources.

Thanks for the advice.

Regards,

[bbilut]

What you're decryption profile look like? This is how I have mine set (it's pretty loose).

[Laurent_Dormond]

Ok adding the self-signed cert to the Trusted root CA cert store fixed this issue.

Many thanks for your help.

Regards

[Brandon_Wertz]

@Laurent_Dormond From the PCAP you should have been able to see an "untrusted certificate" alert

[bbilut]

FYI: We push our cert out to Windows machines with group policy, iOS devices with our MDM solution (Airwatch), and to our Chromebooks with the Google Mgmt console. That only leaves personal devices (byod), so we put the cert up on our web site with instructions on who to install it.