SSL Decryption: SHA1-Intermediate certificate gets decrypted, even if not allowed to

[mrkskhn]

Hi paloalto community,

I tested my new ssl decryption rules against the badssl dashboard ( https://badssl.com/dashboard/ ).

So far it looks good. Unfortunately the check for sha1-intermediate doesn’t pass. Our PA-850 (Firmware 9.0.5) does create a secure connection to this site for the client ( https://sha1-intermediate.badssl.com/ ), even I configured to not support SHA1.

Here is my configuration:

Is there something I forgot to configure?

Thanks and best regards,

Markus

[jdelio]

This is odd that it would be happening with PAN-OS 9.0.5. As anything like that should have been cleared up. 

There was a prior discussion talking about similar things:

https://live.paloaltonetworks.com/t5/General-Topics/PA-3020-SSL-Decryption-Query/m-p/280993#M75902

But there is no real answer as to why.. 

What browsers? does it matter if you use Edge, Firefox or Chrome?

[mrkskhn]

Same with different browsers 

[mrkskhn]

Some more trouble with decryption:

https://www.lobster.de/

This page gets an untrusted paloalto cert, even it's a valid certificate? Can someone confirm this on his paloalto decryption setup?

[Remo]

Hi @mrkskhn 

At least this website is configured not correctly. The webserver does not send the intemediate certificate in the TLS handshake. Without this intermediate certificate the firewall cannot verify if this certificate is trusted / it is not able to check the certificate path.

You have not 3 possibilities with your current configuration:

1. Import the intermediate cert of this website manually onto your firewall and mark it as trusted root
2. Create a decryption rule with another decryption profile where you allow untrusted issuers and add a custom URL category to that rule where you add websites like this one
3. Try to contact the operator of the website to have them fix the issue

And yes, because paloalto firewalls don't have the intermediate certs locally the "problem" you see will be on all palo fws.