SSL Forward Proxy Edge Browser problems

[ErrantOsi]

Hello,

We have a problem at one of our new locations with the Edge Browser when using SSL Forward Proxy (PA-220).

The problem is as following: When we activate the SSL Forward Proxy, the Edge browser takes very long and sometimes even disconnects when trying to open a normal webpage with TLS. Chrome, Mozilla & Internet explorer are OK. Certificates are also trusted and there are no GPO rules for the Edge browser which could cause problems.

I made a packet capture and noticed following: The server key exchange packet comes in, and then the client takes a long time to respond with the client key exchange (~10seconds). Does anybody have an idea what could cause there a problem? As I wrote, other browsers are OK.

Thanks and regards

[mharding]

What Decryption Profile options do you have enabled on the Policy? 

[ErrantOsi]

Only default values are enabled:

I tested today again and the internet explorer is also affected. Chrome is OK. Seems like Microsoft Browsers have some problems with it.

[ErrantOsi · Accepted solution]

After some more troubleshooting we (my collegue 🙂 ) found the cause for the problem:

The forward-trust certificate name was a hostname which the Firewall could resolve from external. The FW then tried to verify the CRL, but as the FW resolved it to an external address, the verification could not happen as the CRL verification should happen internally. After creating a new forward trust cert with a random name, the decryption was running smoothly.