SSL Inbound decryption -Decryption error

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

SSL Inbound decryption -Decryption error

L4 Transporter

One of my application is not  decrypted i have applied SSL inbound decryption policy  and got decryption-error.

On other hand another application with same intermediate certificate  having decrypted. As same intermediate only  child certificate is change. 

Untitled.png

3 REPLIES 3

L7 Applicator

It is near impossible to answer any speculative issues without logs showing details.. 

 

Looking at past cases, this issue is normally caused by an incomplete certificate chain.

Normally, the workaround for this particular issue to import the entire chain as one bundle. Please follow the document:- https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Install-a-Chained-Certificate-Signed...

 

I hope this helps.

LIVEcommunity team member
Stay Secure,
Joe
Don't forget to Like items if a post is helpful to you!

Certificate chain is also complete intermediate and parent certificate all are complete i have received this already when i apply decryption.

traffic is generating an error message - ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cipher suite mismatch Firewall and server). Capture.PNG

L3 Networker

Sorry for the bump, but it might help others. 

 

I stumbled upon the exact same problem, the problem in this case was that the certificate/key were automatically renewed on the server. This is quite common when using Let's Encrypt with ACME (http-01 or dns-01) challenge. 

 

When getting this error make sure to check if this is the case. 

 

In these cases it makes sense to automate the renewal of the certificates on the firewall with the API, as an example.

curl -k -X POST -F "file=@server.key" "https://1.2.3.4/api/?key=xxx&type=import&category=private-key&certificate-name=server.com&format=pem&passphrase=xxx"
curl -k -X POST -F "file=@server.crt" "https://1.2.3.4/api/?key=xxx&type=import&category=certificate&certificate-name=server.com&format=pem"

 


- If it is broken, fix it. If it ain't broken, make it better.
  • 3657 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!