For details on cookie usage on our site, read our Privacy Policy
Inbound SSL decryption
- LIVEcommunity
- Discussions
- General Topics
- Inbound SSL decryption
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-10-2020 09:02 AM - edited 05-02-2022 12:43 AM
I am trying to set up a TLSv1.3 / TLSv1.2 webserver behind a palo firewall with ssl inbound decryption.
However i seem to get a lot of ssl errors and the website does not work if specific ciphers are not listed first...
For one I would like to understand why that is and even ciphers listed here have issues: https://docs.paloaltonetworks.com/compatibility-matrix/supported-cipher-suites/cipher-suites-support...
Basically, what should the apache config look like for the palo to be able to decrypt the traffic, yet still have the highest possible security (e.g. as rated by https://www.ssllabs.com/ssltest/) ?
Accepted Solutions
- Mark as New
- Subscribe to RSS Feed
- Permalink
02-17-2022 02:38 AM
That wont fully work with TLSv1.2 and TLSv1.3 at the same time, I figured out how to do this a while back and gave an example config to TAC but here it is as reference for everyone...
To support both TLSv1.2 and TLSv1.3 at the same time and use secure ciphers, I found the following to work the best:
Apache:
SSLOpenSSLConfCmd ECDHParameters brainpoolP256r1
SSLOpenSSLConfCmd Curves secp521r1:secp384r1:prime256v1
SSLOpenSSLConfCmd SignatureAlgorithms ECDSA+SHA512:ECDSA+SHA384:ECDSA+SHA256:RSA+SHA512:RSA+SHA384:RSA+SHA256:rsa_pss_rsae_sha512:rsa_pss_rsae_sha256
SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384"
nginx:
ssl_conf_command ECDHParameters brainpoolP256r1
ssl_conf_command Curves secp521r1:secp384r1:prime256v1
ssl_conf_command SignatureAlgorithms ECDSA+SHA512:ECDSA+SHA384:ECDSA+SHA256:RSA+SHA512:RSA+SHA384:RSA+SHA256:rsa_pss_rsae_sha512:rsa_pss_rsae_sha256
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384
this needs a certain minimum version of openssl and apache/nginx 🙂
a bit cumbersome but oh well...
it fulfills palos restrictions/requirements while still offering all compatible and secure ciphers and being compatible to modern browsers (I checked this for TLSv1.2 and TLSv1.3 only as those were the only secure ones).
if anyone does the same in other flavors like lighttpd, haproxy or any other platform that might need customization, please be so kind and post an example here as well so others can adapt it into their configs 🙂
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-10-2020 11:23 AM
Hi,
which PANOS version are you running? Some logs might be helpful as well.
Thanks.
René
// If you like my answer force commit it.
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-10-2020 02:17 PM
running PANOS 10.0.1, log only shows "General TLS protocol error" together with the ciphers that were used
any specific debug or log i should show?
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-12-2020 01:28 PM
@Rene_Boehme or anyone know working ciphers for apache with TLSv1.2 and which ones work TLSv1.3?
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-14-2020 07:41 AM
There is nothing in the sslmgr.log and nothing but the General errors in the UI
the only ciphers that seem to work with Palo decryption on TLSv1.2 and Chrome/Firefox are these two:
AES256-GCM-SHA384:AES128-GCM-SHA256
all others error out even if those ciphers above are also available but not listed first (SSLHonorCipherOrder is set to off)
but with these ciphers which are considered weak, i dont even get forward secrecy and therefore the rating is down to B...
I wonder why the following ciphers dont work:
ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHCHA20-POLY1305-SHA256:CHACHA20-POLY1305-SHA256 or the ECDHE-ECDSA ones which are listed as supported but not shown in the decryption profile settings
anyone have an idea or even just an idea how to troubleshoot this further?
- Slow File Downloads over a new PA3220 in General Topics
- Change forward decrypt trust cert to a new one. in General Topics
- URL Filtering log with action allow in General Topics
- PA-450 Internet Traffic stops after 15 minutes in General Topics
- no decryption policy set, wan to wan traffic decrypt is yes in General Topics
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
