Decryption exception issue - no SNI - SCN: chat.signal.org

[JarerkZajac]

Hi,

how to add following decryption error (ssl-forward-proxy) to exceptions?

- logs->decryption: dest address: ac88393aca5853df7.awsglobalaccelerator.com (shodan solves this ip /13.248.212.111/ also to service.signal.org; SNI - no value; SCN: chat.signal.org; error: General TLS protocol error

- logs->traffic: destination like above; decrypted: no; app: ssl; session end reason: decrypt-cert-validation; action: allow; type: end

What I have done:

- device->cert management->SSL decrypt exclusion: chat.signal.org and *.signal.org -> exclude from decryption

Other (almost all) exceptions work fine, but only this cert has no value for SNI (Server Name Indication).

[aleksandar.astardzhiev · Accepted solution]

Hi @JarerkZajac ,

You can create Decryption rule, matching by destination address and using FQDN object with action set to "no decrypt"

[JarerkZajac]

Hi Astardzhiev,

thank you for answer and apologise for late reply. I solved this problem by adding FQDN to URL custom category and using it in decryption rule as no decrypt url category.

Chat.signal works fine, but lately another: signal messenger started the same -> no SNI, no SCN (subject common name), at the same IP/FQDN address. So I added new decrypt rule and added this address.

Thank you again for reply and solution.

Best

Jarek