Inbound Decryption Advice to overcome Decrypt error

[SteveWright]

I am asking for help to get SSL Inbound decryption working. I have read all the posts and tried everything I can think of but I keep getting the decrypt error status so I may have a basic misunderstanding. If someone has an insight into what I am doing wrong after reading the information below I would be grateful to receive it.

The web server is restricted by group policy to a few encryption algorithms that the Palo Alto firewall supports being:

• TLS_RSA_WITH_AES_128_CBC_SHA256

• TLS_RSA_WITH_AES_256_CBC_SHA256

• TLS_RSA_WITH_AES_128_GCM_SHA256 (0x009c)

• TLS_RSA_WITH_AES_256_GCM_SHA384 (0x009d)

I have tried a certificate issued by “GoDaddy” and also a certificate issued by my internal CA but I get the same result from each. The clients trust both certificate authorities. When the client connects, one packet appears to be decrypted but the rest produce a Decrypt error. A capture shows no errors.

The “Client Hello” appears normal listing its supported encryption algorithms followed by a “Server hello, Change Cipher Spec” which looks like it sets the Encryption algorithm to “TLS_RSA_with_AES_128_CBC_SHA256”. This is followed by a “Change Cipher Spec, Encrypted Handshake Message” which I am unsure what this does. These all appear below.

Client Hello

 Client helloServer HelloChange Cipher

[SteveWright]

I kept researching and found a post by Anil Kumar that indicated the issue may be the TLS Extension "Extended Master Secret". If I disable this on the server ad the client, decryption works. Disabling this only on the server seems to be insufficient for decryption to work. The problem now is what to do. Do I downgrade from TLS to SSL or do I forgo decryption. I would be interested in your comment on these options.

Does anyone know if/when Palo Alto will support this Extension for decryption?

[SteveWright]

To complete the story: Soon after my post in August I was informed that a flaw in implementing Extended Master Secret would be fixed soon. An update issued soon thereafter fixed the issue.