SSL Inbound decryption -Decryption error

[Joshan_Lakhani]

One of my application is not  decrypted i have applied SSL inbound decryption policy  and got decryption-error.

On other hand another application with same intermediate certificate  having decrypted. As same intermediate only  child certificate is change. 

[jdelio]

It is near impossible to answer any speculative issues without logs showing details.. 

Looking at past cases, this issue is normally caused by an incomplete certificate chain.

Normally, the workaround for this particular issue to import the entire chain as one bundle. Please follow the document:- https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Install-a-Chained-Certificate-Signed...

I hope this helps.

[Joshan_Lakhani]

Certificate chain is also complete intermediate and parent certificate all are complete i have received this already when i apply decryption.

traffic is generating an error message - ERR_SSL_VERSION_OR_CIPHER_MISMATCH (Cipher suite mismatch Firewall and server). 

[robmaas]

Sorry for the bump, but it might help others. 

I stumbled upon the exact same problem, the problem in this case was that the certificate/key were automatically renewed on the server. This is quite common when using Let's Encrypt with ACME (http-01 or dns-01) challenge. 

When getting this error make sure to check if this is the case. 

In these cases it makes sense to automate the renewal of the certificates on the firewall with the API, as an example.

curl -k -X POST -F "file=@server.key" "https://1.2.3.4/api/?key=xxx&type=import&category=private-key&certificate-name=server.com&format=pem&passphrase=xxx"

curl -k -X POST -F "file=@server.crt" "https://1.2.3.4/api/?key=xxx&type=import&category=certificate&certificate-name=server.com&format=pem"