SSL Forward Proxy Edge Browser problems

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

SSL Forward Proxy Edge Browser problems

L1 Bithead

Hello,

We have a problem at one of our new locations with the Edge Browser when using SSL Forward Proxy (PA-220).

The problem is as following: When we activate the SSL Forward Proxy, the Edge browser takes very long and sometimes even disconnects when trying to open a normal webpage with TLS. Chrome, Mozilla & Internet explorer are OK. Certificates are also trusted and there are no GPO rules for the Edge browser which could cause problems.

 

I made a packet capture and noticed following: The server key exchange packet comes in, and then the client takes a long time to respond with the client key exchange (~10seconds). Does anybody have an idea what could cause there a problem? As I wrote, other browsers are OK.

grafik.png

Thanks and regards

1 accepted solution

Accepted Solutions

L1 Bithead

After some more troubleshooting we (my collegue 🙂 ) found the cause for the problem:

The forward-trust certificate name was a hostname which the Firewall could resolve from external. The FW then tried to verify the CRL, but as the FW resolved it to an external address, the verification could not happen as the CRL verification should happen internally. After creating a new forward trust cert with a random name, the decryption was running smoothly.

View solution in original post

3 REPLIES 3

L4 Transporter

What Decryption Profile options do you have enabled on the Policy? 

Only default values are enabled:

grafik.png

I tested today again and the internet explorer is also affected. Chrome is OK. Seems like Microsoft Browsers have some problems with it.

L1 Bithead

After some more troubleshooting we (my collegue 🙂 ) found the cause for the problem:

The forward-trust certificate name was a hostname which the Firewall could resolve from external. The FW then tried to verify the CRL, but as the FW resolved it to an external address, the verification could not happen as the CRL verification should happen internally. After creating a new forward trust cert with a random name, the decryption was running smoothly.

  • 1 accepted solution
  • 4321 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!