Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 4 replies
  • Subscribers 43 subscribers
  • Views 12599 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSL/TLS Decryption rule errors

Akilae

Hello everyone,

Since v20 I need to disable / enable a SSL/TLS Decryption rule nearly every to every 2 days. It stops processing traffic and on a client device it "feels" like the internet is down. This instantly recovery after disabling / enabling the rule.

The SSL/TLS Log Area shows the following errors when this happens.

Anybody has suggestions on how to stop this? Is this a bug?



This thread was automatically locked due to age.
Parents
  • 0

    Hi Akilae,

    seems we have the same problems here... Have you found a solution for that behaviour?

    Greetings

    Marco

  • 0 in reply to Marco Kling

    The underlying issue is that we upgraded openssl in v20, which changes default support for certain encryption types.  If you use the out of box "SecurityAppliance_SSL_CA" or the "Default" CA then everything is fine.

    However if you changed to use the Default CA, and have also regenerated the Default CA as EC then it will fail to load the CA on startup.  This is due to an order of operations issue where we load the CA before enabling encryption types.  Changing the configuration later causes a reload of the CAs, which now works because the support for encryption types has already been done (at service start).

    The reason it periodically stops working every few days the XG downloads new ips signatures and restarts the ips process, leading to the order-of-operations during start.


    Workaround Option 1:
    Go to Web > General Settings > HTTPS scanning certificate authority and change to SecurityAppliance_SSL_CA
    Go to Rules and policies > SSL/TLS inspection rules >>SSL/TLS inspection settings and make the same change for the Re-sign with.
    Note: This will change the CA which means you will need to redeploy the new CA you are using to the clients.

    Workaround Option 2:
    Go to Rules and policies > SSL/TLS inspection rules and disable (turn off) all rules.
    Wait for the hotfix to be deployed (I will notify this thread).
    Re-enable the Decrypt rules
    Note: This will lower protection and visibility for awhile until the hotfix is available.  But there is no impact to end users.

    We will be doing a hotfix for this.

    Edit: Added additional workaround and confirmed hotfix.

Reply
  • 0 in reply to Marco Kling

    The underlying issue is that we upgraded openssl in v20, which changes default support for certain encryption types.  If you use the out of box "SecurityAppliance_SSL_CA" or the "Default" CA then everything is fine.

    However if you changed to use the Default CA, and have also regenerated the Default CA as EC then it will fail to load the CA on startup.  This is due to an order of operations issue where we load the CA before enabling encryption types.  Changing the configuration later causes a reload of the CAs, which now works because the support for encryption types has already been done (at service start).

    The reason it periodically stops working every few days the XG downloads new ips signatures and restarts the ips process, leading to the order-of-operations during start.


    Workaround Option 1:
    Go to Web > General Settings > HTTPS scanning certificate authority and change to SecurityAppliance_SSL_CA
    Go to Rules and policies > SSL/TLS inspection rules >>SSL/TLS inspection settings and make the same change for the Re-sign with.
    Note: This will change the CA which means you will need to redeploy the new CA you are using to the clients.

    Workaround Option 2:
    Go to Rules and policies > SSL/TLS inspection rules and disable (turn off) all rules.
    Wait for the hotfix to be deployed (I will notify this thread).
    Re-enable the Decrypt rules
    Note: This will lower protection and visibility for awhile until the hotfix is available.  But there is no impact to end users.

    We will be doing a hotfix for this.

    Edit: Added additional workaround and confirmed hotfix.

Children
Unfiltered HTML