Solution for "SSL decryption bypass for Anydesk"

OZamir · ‎02-11-2021

Hello,

I am being asked a lot about why is Anydesk getting a "decrypt-error" end reason when SSL Decryption is active.

Here is a simple explanation and how to overcome this.

What you usually going to do with this kind of errors is creating a Decryption bypass rule for Anydesk (in this example)

Since is it impossible to bypass based on application, you would probably use a Custom URL category with a wildcard (*.anydesk.com), and apply it in a bypass rule. Unfortunately, this doesn't work (I'm not sure why, I think Anydesk uses IP addresses and not URLs)

The other option I came across is using an FQND (relays.net.anydesk.com) published in one of the related articles, that also didn't work for me. It was not consistent.

Then I found that Anydesk is being bypassed by default in PANOS (Device --> Certificate management --> SSL Decryption Exclusion).

Then why isn't it being bypassed?!

Well, it is because of the certificate Anydesk uses. It is using a Self-Signed certificate, and your device does not trust it (yet).

This is the reason for the decrypt-error.

Basically, what you would like to do now is:

Start a packet capture and export the CA certificate.

Then, import the certificate to your device, and mark it as a trusted CA.

Commit, and now Anydesk should work.

I am sharing here the CA certificate currently being used by Anydesk.

Copy the text below to a text file and rename it to ".crt"

Hope this is helpful.

Cheers!

Tomasz_W · ‎04-09-2024

Hi Guys,

It works without certificate. Solution by @CosminM with a twist:

So, create URL list with those:

anynet%20relay/
anynet%20relay:80/
anynet%20relay:6568/
anynet relay:6568/
anynet relay:80/
anynet relay/

Decryption profile like that:

And Decryption rule like that:

And this is how it looks in logs:

I hope this helps 🙂

S.Support212931 · ‎04-09-2024

so we have to create a service port for that decryption rule ? ( see my pic )

CosminM · ‎04-09-2024

Hi @S.Support212931 ,

One of the steps it's to create a service for TCP destination port 6568. The source port it's dynamic and in your service should be empty.

Regards,
Cosmin

MatwoksNetTeam · ‎04-09-2024

I see 2 issues with this

1. This solution doesn't just allow anydesk to bypass the decryption - it basically allows everything to bypass the decryption for destination port 80 and 6568. How to you make sure only anydesk is allowed in this case ?

2. Even if we find a way to make it only for anydesk - it then bypass the decryption which is not something we want.
What is someone transfers a malicious file through anydesk during the session - How will the firewall be able to see it if decryption is off.

ArtursOstapenko · ‎04-09-2024

This is reply what I've got from AnyDesk support:

AnyDesk does not use the PKI (public key infrastructure). Instead, we use our own trust chain to validate the server certificates. This gives us more control over the process and the certificate validation. For example, you can not just install a certificate as a trusted root certificate on the computer and use it to man-in-the-middle the connection.

Usually, you need to check the common name, so that someone can not use a certificate that was rightfully generated for domain a.com for another domain b.com, that he does not have access to. We do not generate certificates for other people or purposes, so in our case, it is enough to know that the certificate was signed by our CA.

This error happens because the system checking the certificate does not trust our root CA. The AnyDesk client however will.

There is no issue with the certificate being self-signed because the client generates the certificate by itself on the first start and it will only be linked to a new AnyDesk client ID on the server.

Tomasz_W · ‎04-10-2024

Hi,

that URL list is there to make this work for Anydesk only and yes, it disables decryption totatly.

MatwoksNetTeam · ‎04-10-2024

Thank Tomaz - noted
Can you please share a screenshot from the URL list you made.

Tomasz_W · ‎04-10-2024

Here it is:

That's all I can show without compromizing company setup 🙂

MatwoksNetTeam · ‎04-10-2024

I was able to find the new private certificate from some captures (but unlike in the past the new certificate is encrypted thus it does not work any more

I guess bypass it is for now..!!!
But people can pass malicious files through anydesk-app now and firewall will not be able to detect them

CosminM · ‎04-10-2024

Hi @MatwoksNetTeam

Even in the past, importing the Anydesk Root CA into the firewall did not mean that we were decrypting the traffic.

Then we just mark that issuer as reliable.
So, the risk of transferring malicious files is the same, that's why it's good to have security solutions on the end-points as well.

I just updated my older post (https://live.paloaltonetworks.com/t5/general-topics/anydesk-issue/td-p/198761/page/2) to match the new Apryl 2024 changes.

Regards,
Cosmin

S-Battermann · ‎04-11-2024

CosminM · ‎04-11-2024

Thank you @S-Battermann for the new certificate. I tested and it's working.

I even update the full procedure from my older post.

Regards,
Cosmin

ArtursOstapenko · ‎04-11-2024

Any chance you can share method how you got this certificate?

MatwoksNetTeam · ‎04-11-2024

Found the same certificate - Was given to me directly from Anydesk support

S-Battermann · ‎04-11-2024

Was given to me directly from Anydesk support

Unlock your full community experience!

Solution for "SSL decryption bypass for Anydesk"

Solution for "SSL decryption bypass for Anydesk"

Show your appreciation!