Decryption: Client and decrypt profile version mismatch

[LCMember40912]

Hi folks,

Have been seeing a lot of "'Client and decrypt profile version mismatch. Supported client version bitmask: 0x08. Supported decrypt profile version bitmask: 0x60. ' errors in the log lately. This article:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/troubleshoot-and-monitor-decry...

indicates that the client is trying TLS 1.0, whereas the decryption profile only supports > TLS 1.2. I don't see how this could be since the clients generating these are all fully updated Win10, which should use TLS 1.2 by default. I've checked in the 'Internet Options' control panel item on these clients and TLS 1.2 is in fact selected. I've tried to get packet captures, but these happen at random times to random IP adresses, so it has been difficult. My only thought is that some application is attempting to force a connection using TLS 1.0? Any other thoughts on what it could be?

Thanks!

[ILobdell]

I am having this same problem with a specific site.  www.wordstream.com it triggers 100% of the time.  I've even tried to lower my decryption policy to accept TLSv1.0 and it still fails with a similar error: Client and server version mismatch. Supported client version bitmask: 0x08.

Previous to the downgrade attempt in my decryption profile I had the exact same error as you.  I'm wondering if whatever is on the front end of this site is sending some odd requests back.  Feel free to test with this site as it fails for me it will hopefully fail for you with the same error.

[mariolopez]

Hello,

Have you had any luck resolving this issue? Running into that exact issue on one of our sites.