PA-820 random Decyption Error

[PolymerHolding]

Since a few month we got more and more random outbound decryption errors. When the user wait a moment the website will automatically open correct. The browser error messages are "err_connection_reset" or net:err_cert_authority_invalid". In the decryption error log i see errors like "certificate verifiy failed", "malloc failure", "General TLS protocol error". At the moment i have installed the Version 10.2.10-h4 at our PA-820 (HA). Did anyone have the same problems. I have an opened a ticket and at the moment i wait for further actions.

[Raido_Rattameister]

Identify site where decryption is failing.

Go to SSLLabs and run test.

Does website include intermediate certificate or is it extra download?

If website is not sending intermediate then Linux based machines (including Palo firewall) don't download it.

[PolymerHolding]

This isn´t a problem with the sites ( like missing Intermediate Certificate). I open a site and i get the error message. When i close the site and open it a little bit later again the site will be correct loaded (our when i leave the site and refresh it a little bit later). I think it a decryption performance problem but we can´t see it in the firewall. 

[Raido_Rattameister]

One of your errors was "certificate verifiy failed".

Does it make any difference if you temporarily (just for testing) uncheck "Block sessions with unknown certificate status" and "Block sessions on certificate status check timeout" under Decryption Profile?

[PolymerHolding]

I have test it. It didn´t make any difference.