SSL routines::unsafe legacy renegotiation disabled

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

SSL routines::unsafe legacy renegotiation disabled

L2 Linker



We are getting an increasing number of users reporting issues connecting through the Palo Altos when using OpenSSL3. Here is the information I have:

"We've got someone working on moving to Node-18 from 14. We're getting issues in the build pipeline where OpenSSL3 is failing to connect through the proxy. We get the error unsafe legacy renegotiation disabled - google says the proxy box needs to support RFC 5746. Is there any information on the proxy box and who manages it so we can investigate/come up with a workaround?"


"We have reproduced this issue while working to build new ADO agent images - Ubuntu 22.04's version of openssl3 also blocks all outbound ssl connections with the same error:
1$ curl
2curl: (35) error:0A000152:SSL routines::unsafe legacy renegotiation disabled
We obviously do not wish to enable the UnsafeLegacyRenegotiation option."

I see this has also been reporting on the Palo Alto forums at

Is there a solution to this issue please?


(not sure if this is the right board-please redirect if not-thanks)


L0 Member



does anyone have an idea / updates on this issue ?


We are seeing the same Problems when using OS/Tools with openssl 3.x there is no connection via SSL working.


Many thanks for keeping this thread alive.




I have had a reply from Palo Alto TAC-

'This is kb article, and I confirmed that PA does not support SSL/TLS Renegotiation.'


Create Decryption exception for the HTTPS sites that fail due to SSL renegotiation.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!