SSL decryption fails

[montgomery]

We are testing SSL decryption on our PA at the moment. We have found a site that could not be decrypted: https://posteo.de/

Has anyone of you an idea why the decryption fails for that site?

And how could I troubleshoot such problems? Because the normal log does not show any problem, but the browser shows an error message.

Thank you!

[kprakash]

Good Morning,

I just checked the certificate for https://posteo.de/ and it is signed by StartCom. It also has an intermediate certificate as shown.

Can you verify if Startcom is part of the Default Trusted Certificate Authorities?

Are you being presented with a forward Untrust Certificate? Also are we "Blocking sessions with untrusted issuers" ?

BR,

Karthik

[hag]

Hi Karthik,

Can you verify if Startcom is part of the Default Trusted Certificate Authorities?

- Yes it is part of the default trusted certificate authorities

Are you being presented with a forward Untrust Certificate?

- No certificate is shown. IE just shows "This page cannot be displayed"

Also are we "Blocking sessions with untrusted issuers" ?

- No.

Thanks!

[kprakash]

From what you have stated, it looks like we are either not seeing the entire TCP handshake completing for the SSL traffic, or there are some parameters on the Server Certificate that the PANFW doesnt like. If you set the action to No-Decrypt under the Decryption profile, does the webpage load?

Best regards,

Karthik RP

[hag]

Yes when we do no decrypt the page is loading as expected.

[kprakash]

It failed on our end as well, although we decrypted the traffic.