SSL routines::unsafe legacy renegotiation disabled

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

SSL routines::unsafe legacy renegotiation disabled

L2 Linker

Hi,

 

We are getting an increasing number of users reporting issues connecting through the Palo Altos when using OpenSSL3. Here is the information I have:

"We've got someone working on moving to Node-18 from 14. We're getting issues in the build pipeline where OpenSSL3 is failing to connect through the proxy. We get the error unsafe legacy renegotiation disabled - google says the proxy box needs to support RFC 5746. Is there any information on the proxy box and who manages it so we can investigate/come up with a workaround?"


And

"We have reproduced this issue while working to build new ADO agent images - Ubuntu 22.04's version of openssl3 also blocks all outbound ssl connections with the same error:
1$ curl https://google.com
2curl: (35) error:0A000152:SSL routines::unsafe legacy renegotiation disabled
We obviously do not wish to enable the UnsafeLegacyRenegotiation option."

I see this has also been reporting on the Palo Alto forums at https://live.paloaltonetworks.com/t5/globalprotect-discussions/rfc5746-issue-with-ssl-decryption-ope....

Is there a solution to this issue please?
Thanks,

 

(not sure if this is the right board-please redirect if not-thanks)

1 accepted solution

Accepted Solutions

Hi,

 

I have had a reply from Palo Alto TAC-

'This is kb article, and I confirmed that PA does not support SSL/TLS Renegotiation.'
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POJ0CAO&lang=en_US%E2%80%A...

 

Workaround:
Create Decryption exception for the HTTPS sites that fail due to SSL renegotiation.

View solution in original post

9 REPLIES 9

Community Team Member

Hi @CraigAddison ,

 

Is SSL Decryption enabled on the firewalls? 

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

Hi JayGolf,

 

Yes SSL Decryption is enabled on the firewalls.

Hi JayGolf, 

 

Did you have any follow up to this please?

Community Team Member

Hi @CraigAddison ,

 

I would recommend reaching out to TAC for this issue as there doesn't appear to be any documentation regarding this. Please share any details you discover with TAC. 

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.

L0 Member

Hello,

 

does anyone have an idea / updates on this issue ?

 

We are seeing the same Problems when using OS/Tools with openssl 3.x there is no connection via SSL working.

 

Many thanks for keeping this thread alive.

 

Hi,

 

I have had a reply from Palo Alto TAC-

'This is kb article, and I confirmed that PA does not support SSL/TLS Renegotiation.'
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POJ0CAO&lang=en_US%E2%80%A...

 

Workaround:
Create Decryption exception for the HTTPS sites that fail due to SSL renegotiation.

L2 Linker

This has been fixed in "PAN-184630: Fixed an issue where TLS clients, such as those using OpenSSL 3.0, enforced the TLS renegotiation extension (RFC 5746)." Target releases:

  • 11.0.2 - ETA July 2023
  • 10.2.5 - ETA  August 2023
  • 10.1.11 - ETA - September 2023
  • 9.1.17 - ETA October 2023

 

See: https://live.paloaltonetworks.com/t5/globalprotect-discussions/rfc5746-issue-with-ssl-decryption-ope...

UPDATE: Per case 02716405, Prisma Access has PAN-184630 integrated into 4.0.0-Preferred dataplane version 10.2.4-ch171. 

 

Will be testing this at the end of this week.

UPDATE: Testing of PAN-184630 was successful with Prisma Access 4.0.0-Preferred dataplane version 10.2.4-ch171. Having the rest of our gateways upgraded in next available change window.

  • 1 accepted solution
  • 46001 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!