SSL decryption( Some traffic is not decrypted)

[Jafar_Hussain]

Dear All,

I have applied SSL forward decryption in my Paloalto, then i observed some traffic are decrypted and some traffic not decrypt.

Example:- I have applied the decryption in social-networking (Facebook traffic is decrypted but Snapchat traffic is not decrypted,however, both are falling under the social-networking category.)

Why it's strange behaviour.

[Jafar_Hussain]

@BPry @Remo 

hello,

Now the problem is chrome is accepting the certificate, but I am not able some websites in the chrome browser.

Ex:- I have applied decryption only for youtube and NetFlix. but when I open Netflix it is working fine below is the screenshot for Netflix:-

But When I open youtube in chrome, getting the error. below is the screenshot.

I have changed certificates already with SHA 512 value but still issue persists.

Could you please help me with this.

[Jafar_Hussain]

@BPry @Remo  

Could you please update on this,

[Remo]

@Jafar_Hussain 

Neither @BPry nor me @BPry  are working for Paloaltonetworks. We use our free time to try to help here in the community. So if you cannot wait more than 3 hours (as you asked again for an update here 3 hours after your post with the cert warnings) you should contact official paloalto support.

Anyway, which certificate did you change to SHA512? Was it really the CA cert used for decryption? What key size did you configure for the dynamically created certificates? Could you show a screenshot of the cert?

[Jafar_Hussain]

@Remo 

Sorry for this.

I have configured a new CA certificate with keysize- 2048 and sha 512.

[Remo]

@Jafar_Hussain 

and you did configure this new ca cert as "Forward Trust Certificate"?

[Jafar_Hussain]

@Remo 

Yes, I configured as a forward trust cert.

[Remo]

could you share the dynamically created cert (via export from the browser)?

did you clear the local cert cache? maybe the cert you see is still the one created with the old CA cert.

[Jafar_Hussain]

@vsys

I have performed this task:-

1 – Clear the SSL state from the system.

Windows+r > inetcpl.cpl>content>clear SSL state>OK

2- Cleared browsing data.

Give me some time I will share the certificate also.

[Remo]

I was talking about the cert cache on the firewall

[Jafar_Hussain]

@Remo 

I have cleared the cache only from the system.

How, I clear from the firewall. it will impact of running operation?