[RFC5746] issue with ssl decryption: openssl3.0 unsafe legacy renegotiation disabled

Showing results for 
Show  only  | Search instead for 
Did you mean: 

[RFC5746] issue with ssl decryption: openssl3.0 unsafe legacy renegotiation disabled

L0 Member

Since I upgraded to the lastest fedora, all of my python/ansible script failed when they are decrypted by our palo alto ssl outbound policy.


After some diging, fedora 35 was using openssl 1.1.1 and fedora 36 switched to openssl 3.0: https://fedoraproject.org/wiki/Changes/OpenSSL3.0


On the openssl 3.0 changelog, we can find this:

OPENSSL changelog between 1.1.1 and 3.0.0 [7 sep 2021] contains:

* Support for RFC 5746 secure renegotiation is now required by default for SSL or TLS connections to succeed.


I found a post on a stackoverflow that explain how to reenable unsecure renegociation to have a quick fix. This won't be a good solution when all our devs will be using linux and dockers with openssl 3.0 installed.


Is there a way to configure ssl decryption on the palo alto to enable secure renegociation ?


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!