Errors - ROOT CA authority untrusted / invalid

[vij]

PA-VM Series 8, vm-mode: Microsoft Azure

sw-version: 10.1.6-h6 global-protect-client-package-version: 5.2.1

Issue:

when trying to access websites, we are getting a lot of errors saying that the ROOT CA authority is untrusted/invalid

Error details: Received fatal alert CertificateUnknown from the client. CA Issuer URL (truncated):http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA

Certificate Information,

CA- Trusted Root CA

status Valid

[SARowe_NZ]

Hi,

The error states this has come from the client and means that the client does not trust the issue URL. Palo has pulled out the originating CA Cert for you but the issue is most likely you are doing decryption and the client does not trust your decryption cert. This is either because:

1) it does not have the decryption cert chain installed and/or trusted

2) the browser is not using the machine trust store (e.g. firefox) and maintains its own trust store that will need the cert chain adding

We also see this when the traffic is from inside an application that does not use the machine trust store, or is doing cert pinning but you state your issue is with browsing so probably not that.

Cheers,

Shannon

[vij]

I will try  & let me know.

[SARowe_NZ]

As a test, or if you completely trust this particular website, you could also exclude it from decryption; but I always prefer to resolve it properly and allow the firewall to decrypt and inspect the traffic for threats instead of just excluding decryption and blinding trusting it.

[VirupakshaRajapur]

Hi,

Anyone get the solution for this issue. we are getting the same issue 

Received fatal alert CertificateUnknown from client. CA Issuer URL (truncated):http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20ECC%2

We are looking for the permanent fix as solution given in below article is the workaround for which lot of manual task need to do.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decry...

[Raido_Rattameister]

Can you give one example URL where you get CA cert error?

This usually happens if website don't include intermediate cert in the chain.

Windows download intermediate certificates automatically but Linux (and Palo) does not.

Unfortunately vast amount of website admins have no idea how certificates work and what they should include...

[VirupakshaRajapur]

Hi, Raido_Rattameister

Below are the some URLs for which we are getting the decryption issue.

As per the workaround https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/decryption/troubleshoot-and-monitor-decry... it's not very practical to add intermediate certificate in firewall for each and every URL and it's time consuming as well. Not sure if there is any alternate fix for this issue.

http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt
http://crt.e2m02.amazontrust.com/e2m02.cer
http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA
http://www.microsoft.com/pki/mscorp/Microsoft%20RSA%20TLS%20CA%
http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20ECC%2
http://www.microsoft.com/pkiops/certs/Microsoft%20Azure%20TLS%2
http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt
http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt
http://cacerts.geotrust.com/GeoTrustTLSRSACAG1.crt
http://cacerts.thawte.com/ThawteRSACA2018.crt
http://pki.goog/repo/certs/gts1c3.der
http://r3.i.lencr.org/
http://zerossl.crt.sectigo.com/ZeroSSLECCDomainSecureSiteCA.crt

[asmaaelkandoussi]

Hi , 

Any solution for that problem 

Thank you 

[Raido_Rattameister]

Problem is not on the firewall but clueless website administrators who don't follow standards.

RFC states:

“If the server is authenticated, its certificate message must provide a valid certificate chain leading to an acceptable certificate authority.”
https://datatracker.ietf.org/doc/html/rfc5246

If website does not attach intermediate in cert chain then you can either remove those sites from being tested against trusted CA check or upload those intermediate CA certs into Palo manually.