What encryption is my SSL connection using?

[Kerri.Stahl]

We're on 9.0.9 and want to turn on the feature allowing users to connect to GlobalProtect using SSL if there is a need.

Is there anywhere in the Monitor tab you can look to find what encryption is used for a particular users connection?

I read this where it says, "The gateway responds to the request and selects the encryption and authentication algorithm to use based on the configuration of the GlobalProtect IPSec Crypto Profile (Get-Config-Response)." In our GlobalProtect IPSec Crypto Profile we have two options entered: aes-128-gcm and aes-256-gcm, so that doesn't clearly tell me which one will be used and it sounds like it could be either. The TLS version being used is 1.2, if that influences the selection...

[S.Cantwell]

If you keep the default PANW GP settings, you will be using TLS1.0.

As of March 2020, browser support (Chrome, Firefox, IE products) have removed support for TLS 1.1 and TLS 1.0

You should ONLY be allowing TLS 1.2.

TLS and SSL are the same, so your users are using SSL, but technically, the protocol is TLS.

[Marie_Jenner]

1. Examine your browser
The majority of contemporary web browsers include information about the encryption employed over an SSL/TLS connection:

Chrome by Google:

In the address bar, click the padlock icon.
Depending on the version of Chrome you are using, choose "Certificate" or "Connection is secure".
To view details about the encryption protocol and cipher suite, click "Details".
Firefox Mozilla:

In the address bar, click the padlock icon.
To get more details, click the arrow or "Connection secure".
Click "More Information" to see the details of the encryption under "Security".
Microsoft Edge:

In the address bar, click the padlock icon.
Select "Certificate (Valid)" or an analogous choice.
Examine the information in the certificate window's "Details" tab.
Safari:

Click on the padlock icon in the address bar.

Select "Show Certificate" to view details about the SSL/TLS connection.

Check the "Details" tab to find encryption information.

2. Make Use of Internet Resources
A website's encryption can be examined using a number of online tools:

Visit SSL Labs' SSL Test, type in your domain, then click "Run" to begin the test. It offers a thorough report on the SSL/TLS settings, covering cipher suites and encryption algorithms.

Why Is There No Padlock? To verify a website's SSL/TLS settings, including the encryption details, go to Why No Padlock?

3. Use Command Line Tools to Verify
Additionally, you can examine SSL/TLS connections using command-line tools:

OpenSSL: OpenSSL allows you to inspect the encryption details by connecting to a server.

4. Examine the certificate
You can use a variety of tools to examine the certificate itself in order to see the encryption specifics of a specific certificate. This involves using programs like certutil on Linux or the previously listed methods to examine the certificate's data.

You may find out which cipher suites and encryption protocols are being used on your SSL/TLS certificate by utilizing these techniques.

[Brandon_Wertz]

---

@Kerri.Stahl wrote:

We're on 9.0.9 and want to turn on the feature allowing users to connect to GlobalProtect using SSL if there is a need.

Is there anywhere in the Monitor tab you can look to find what encryption is used for a particular users connection?

I read this where it says, "The gateway responds to the request and selects the encryption and authentication algorithm to use based on the configuration of the GlobalProtect IPSec Crypto Profile (Get-Config-Response)." In our GlobalProtect IPSec Crypto Profile we have two options entered: aes-128-gcm and aes-256-gcm, so that doesn't clearly tell me which one will be used and it sounds like it could be either. The TLS version being used is 1.2, if that influences the selection...

---

When this thread was written there wasn't a way, but either as of 10.0.X or 10.1.X Palo Alto introduced "decryption" logs that allow you to see the TLS ciphers and algorithms used over HTTPS.

[Brandon_Wertz]

---

@Marie_Jenner wrote:

1. Examine your browser
The majority of contemporary web browsers include information about the encryption employed over an SSL/TLS connection:

Chrome by Google:

In the address bar, click the padlock icon.
Depending on the version of Chrome you are using, choose "Certificate" or "Connection is secure".
To view details about the encryption protocol and cipher suite, click "Details".
Firefox Mozilla:

In the address bar, click the padlock icon.
To get more details, click the arrow or "Connection secure".
Click "More Information" to see the details of the encryption under "Security".
Microsoft Edge:

In the address bar, click the padlock icon.
Select "Certificate (Valid)" or an analogous choice.
Examine the information in the certificate window's "Details" tab.
Safari:

Click on the padlock icon in the address bar.

Select "Show Certificate" to view details about the SSL/TLS connection.

Check the "Details" tab to find encryption information.

2. Make Use of Internet Resources
A website's encryption can be examined using a number of online tools:

Visit SSL Labs' SSL Test, type in your domain, then click "Run" to begin the test. It offers a thorough report on the SSL/TLS settings, covering cipher suites and encryption algorithms.

Why Is There No Padlock? To verify a website's SSL/TLS settings, including the encryption details, go to Why No Padlock?

3. Use Command Line Tools to Verify
Additionally, you can examine SSL/TLS connections using command-line tools:

OpenSSL: OpenSSL allows you to inspect the encryption details by connecting to a server.

4. Examine the certificate
You can use a variety of tools to examine the certificate itself in order to see the encryption specifics of a specific certificate. This involves using programs like certutil on Linux or the previously listed methods to examine the certificate's data.

You may find out which cipher suites and encryption protocols are being used on your SSL/TLS certificate by utilizing these techniques.

---

While useful information what you shared doesn't really help the OP, and doesn't help a firewall administrator understand what keys are being used by systems the firewall sees.