SSL Decryption: ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY

[mrkskhn]

Hi paloalto community,

we're currently still testing ssl decryption and discovered a new error, which I can't google to find a solution.

If we're visiting the following site, we get an "ERR_HTTP2_INADEQUATE_TRANSPORT_SECURITY" error. Site: https://www.1erforum.de/

See attached our configuration and ssl information without decryption enabled.

Firmware and Specs:

PA 850 - FW 9.0.5

Settings:

Decryption disabled:

Decryption enabled:

[BPry]

@mrkskhn,

Might want to take a look at what Cipher suite the connection is attempting to make. HTTP/2 and TLS1.2 can get weird on what cipher suites do/don't cause an error. 

[mrkskhn]

1erforum.de is using:

The connection to this site is encrypted and authenticated using TLS 1.2, ECDHE_RSA with P-256, and AES_128_GCM.

di.fm (same error here too) is using:

The connection to this site is encrypted and authenticated using TLS 1.2, ECDHE_RSA with P-256, and AES_128_GCM.

At this point ssl decryption gets pointless, since a lot of websites are using this combination. Looks like a firmware issue?

[BPry]

@mrkskhn,

The reason that I asked what ciphers it's using is simply due to a lot of websites not actually enabling HTTP/2 correctly, but those all check out and should work perfectly fine. I'm not sure that it's actually a firmware issue, I can check to see if I run into the same issue this evening though. 

[mrkskhn]

That would be great. i'm looking forward to hearing from you.