Google disclaimer and SSL Decryption

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Google disclaimer and SSL Decryption

L3 Networker

Hello,

 

I have enabled SSL decryption on a PA-500 running PanOS 7.0.9 for testing purposes (before enabling in prod environment).

 

All seems to be working fine, except with the Google Disclaimer that randomly occurs and that you have to agree with in order to go ahead with your google searches...

 

Without SSL decryption it displays normally, but with SSL decryption enabled, it only displays a empty (white) frame and the end user can't agree and thus stucks on this page...

 

There is nothing denied or blocked by any PanOS feature, test policy is "any any allow".

 

This is occuring with IE 11 (not tested with another browser).

 

Does anymone ever experienced this issue ?

 

Regards,

 

Laurent

 

 

1 accepted solution

Accepted Solutions

So I'm just going to take an educated guess here after seeing your screen but without your ssl decryption cert being trusted you would have to 'allow' the connection to continue. Since Google isn't pulling that resource from the same server (you can test this with the dev tools network monitoring) it isn't loading the resource because you haven't actually allowed that action to continue with the untrusted cert. If you add that cert into your trusted store then you should see this issue go away. 

View solution in original post

9 REPLIES 9

L6 Presenter

Not for me.

 

Running IE 11.0.9600

 

Maybe try a PCAP from the palo and see what's happening.  That's really only been my recourse when technical SSL issues like you're having.

L3 Networker

Sounds like maybe your SSL cert is not loaded on your computers as a "Trusted Root Certification Authority"

 

I decrypt all our Google traffic so I can enforce safe search, youtube safety-mode, and others. We don't have any problems in Chrome or IE, but Firefox has it's own certificate store and doesn't use Windows.

-Brad

Hi Brad,

 

indeed, my ssl cert is not loaded as "Trusted Root CA cert", since it is just SSL decrypt test purposes.

 

Also I have the "untrusted issuer warning" message in the browser for each decrypted HTTPS website, but it is not a problem for the instance.

 

To add some more visual description of the problem, here are two screenshot with and without ssl decrpytion :

 

 Here with SSL decryption deactivated

no_ssl_decrypt.png Here with SSL decryption enabledssl_decrypt.png

 

So I'm just going to take an educated guess here after seeing your screen but without your ssl decryption cert being trusted you would have to 'allow' the connection to continue. Since Google isn't pulling that resource from the same server (you can test this with the dev tools network monitoring) it isn't loading the resource because you haven't actually allowed that action to continue with the untrusted cert. If you add that cert into your trusted store then you should see this issue go away. 

Hi,

 

That sounds good indeed, I will try out and let you know the result.

 

I remember in the PCAP captures that there were a lots of SSL handshakes (client hello, server hello, ...) that probably means that there are multiple SSL connexions to different resources.

 

Thanks for the advice.

 

Regards,

What you're decryption profile look like? This is how I have mine set (it's pretty loose).

 

2016-09-07 10_28_25-Panorama.png2016-09-07 10_28_38-Panorama.png

-Brad

Ok adding the self-signed cert to the Trusted root CA cert store fixed this issue.

 

Many thanks for your help.

 

Regards

@Laurent_Dormond From the PCAP you should have been able to see an "untrusted certificate" alert

FYI: We push our cert out to Windows machines with group policy, iOS devices with our MDM solution (Airwatch), and to our Chromebooks with the Google Mgmt console. That only leaves personal devices (byod), so we put the cert up on our web site with instructions on who to install it.

-Brad
  • 1 accepted solution
  • 3553 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!