Decryption: Client and decrypt profile version mismatch

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Decryption: Client and decrypt profile version mismatch

L2 Linker

Hi folks,

 

Have been seeing a lot of "'Client and decrypt profile version mismatch. Supported client version bitmask: 0x08. Supported decrypt profile version bitmask: 0x60. ' errors in the log lately. This article:

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/decryption/troubleshoot-and-monitor-decry...

indicates that the client is trying TLS 1.0, whereas the decryption profile only supports > TLS 1.2. I don't see how this could be since the clients generating these are all fully updated Win10, which should use TLS 1.2 by default. I've checked in the 'Internet Options' control panel item on these clients and TLS 1.2 is in fact selected. I've tried to get packet captures, but these happen at random times to random IP adresses, so it has been difficult. My only thought is that some application is attempting to force a connection using TLS 1.0? Any other thoughts on what it could be?

Thanks!

2 REPLIES 2

L0 Member

I am having this same problem with a specific site.  www.wordstream.com it triggers 100% of the time.  I've even tried to lower my decryption policy to accept TLSv1.0 and it still fails with a similar error: Client and server version mismatch. Supported client version bitmask: 0x08.

 

Previous to the downgrade attempt in my decryption profile I had the exact same error as you.  I'm wondering if whatever is on the front end of this site is sending some odd requests back.  Feel free to test with this site as it fails for me it will hopefully fail for you with the same error.

L0 Member

Hello,

 

Have you had any luck resolving this issue? Running into that exact issue on one of our sites.

  • 1865 Views
  • 2 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!