Safari Security Errors

[kevin.shain]

I have suddenly started getting security certificate errors while using Safari.  I am not using a Captive Portal and have no certificates on the PAN, however the certificate errors always point back to a self-signed certificate by the PAN.  I am attaching a screen cap as an example, however please note that the ip #'s it lists vary and they are not my ip #'s.

[pkruse]

Are you using SSL Decrypt? You would  have to use a cert if this is the case. An ssl decrypt session acts like a proxy and could create the type of issue you are describing.

~Phil

[kevin.shain]

I have no rules set under Policies > Decryption, so I am assuming that means I am not using SSL Decrypt?  Not sure if there is anywhere else to look or not.

Thanks.

[bpappas]

if you have no rules under Policies -> Decryption then you are not using SSL decrypt.

are you using a self-signed certificate for the web UI of the Palo Alto firewall?

-Benjamin

[kevin.shain]

Yes, I am using a self signed certificate for the web gui.

Thanks!

[bpappas]

Did you purge your certificate store on Safari? Or maybe you did an upgrade that purged your store of trusted certs?

Either way you can decide to trust the self-signed cert for the web UI of the PAN and that would stop the pop-up.

-Benjamin

[kevin.shain]

The popup does not happen on the web gui, it happens on random websites, mostly when a banner ad or something else is trying to load.  The IP # is not one of mine however it says that the certificate is the self signed one from the PAN.  Makes no sense, but I've seen it happen on multiple machines.

[bpappas]

Are you using captive portal? URL filtering?

I'm trying to isolate what may be causing the "response page" from the PAN device.

-Benjamin

[kevin.shain]

No captive portal, but we do filter URLs.

Thanks!