topic Hi Ravi, in Web Security

https error on websites

andrei.goutnik — Mon, 09 Jan 2017 22:35:42 GMT

I am having an issue with Cisco Web Security Appliance (S380), accessing https websites.

Specifically when trying to access our webmail website i get an error "ERR_SSL_PROTOCOL_ERROR" when running through the Cisco WSA.

The website is https://webmail.austfoot.com.au we have a SSL certificate from DigiCert and i have added the *.austfoot.com.au domain to be bypassed in WSA however i still get the error.

Works fine if not going through the WSA.

It used to work fine, however the Appliance was updated to the latest update and now it has stopped working. I thought i just needed to load the certificate into "Certificate Management" under trusted root, however that didnt work.

Can you post some of the logs

David Niemann — Tue, 10 Jan 2017 01:45:45 GMT

Can you post some of the logs from the access logs when the site is accessed?

Would it be the following?

andrei.goutnik — Tue, 10 Jan 2017 06:05:44 GMT

Would it be the following?

1483928012.640 1 10.1.1.59 TCP_MISS/502 39 CONNECT tunnel://webmail.austfoot.com.au:443/ - DIRECT/webmail.austfoot.com.au - PASSTHRU_WEBCAT_7-DefaultGroup-AFL_Active_Directory-NONE-NONE-NONE-DefaultGroup <IW_sprt,0.0,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_sprt,-,"-","-","Unknown","Unknown","-","-",312.00,0,-,"-","-",-,"-",-,-,"-","-"> -
1483928012.645 4 10.1.1.59 TCP_MISS/502 39 CONNECT tunnel://webmail.austfoot.com.au:443/ - DIRECT/webmail.austfoot.com.au - PASSTHRU_WEBCAT_7-DefaultGroup-AFL_Active_Directory-NONE-NONE-NONE-DefaultGroup <IW_sprt,0.0,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_sprt,-,"-","-","Unknown","Unknown","-","-",78.00,0,-,"-","-",-,"-",-,-,"-","-"> -

You are getting this error

Ravi Singh — Wed, 11 Jan 2017 15:25:29 GMT

You are getting this error only for this URL or whenever you are accessing any https site?

In Some cases, SSL state may blok your connection and show you this error. Try to clear SSL state

Hi Ravi,

andrei.goutnik — Wed, 11 Jan 2017 20:19:26 GMT

Hi Ravi,

Thanks for the reply.

It seems to be happening with all sites that I access under the .austfoot.com.au domain.

Another example is https://connx.austfoot.com.au as soon as I go through the WSA I get the SSL error.

Re: You are getting this error

jonianggara65839 — Sat, 19 Oct 2019 01:51:48 GMT

pertanyaan saya yang ingin saya tanyakan karena kasus yang saya alami hampir sama di ip menuju website Pekalongan news

Re: Would it be the following?

shgrover — Mon, 30 Dec 2019 05:11:36 GMT

Hello andrei.goutnik,

The domain you have mentioned is not being bypassed. I think you added ".austfoot.com.au" to the bypass settings on the WSA when you says you have bypassed it however you have an explicit setup ( either PAC file, Hostname/Ip of the WSA in the browser). Bypass settings on the WSA work only with the Transparent setup (wccp). Please bypass this domain on the PAC file or on the browser it self. you cannot bypass it on the WSA. you can try to make a custom url category also and allow /passthrough it in access/decryption policy and check if it works. If it doesn't then you have bypass it for sure.

Regards

Shikha Grover

PS: Please don't forget to rate and select as validated answer if this answered your question

Re: https error on websites

jameslehner992 — Mon, 13 Jun 2022 23:51:18 GMT

I cant visit half of the website on the internet. The connection is not sure on half of the websites. Anyone know the solution to this?

Re: https error on websites

amojarra — Tue, 14 Jun 2022 20:39:10 GMT

@jameslehner992

kindly share with us more details about your issue.

you can brows some https and can not brose some https site ( approximately 50%-50%)

if so please share the output of sslconfig > versions from CLI and some lines of access logs from blocked URLs and allowed URLs

Re: Would it be the following?

amojarra — Tue, 14 Jun 2022 20:47:27 GMT

Hi @andrei.goutnik

I can see HTTP 502 from your accesslog which is Bad gateway.

If you done the steps @shgrover mentioned and still get 502 from accesslogs, could you please capture packet from WSA filter for your client IP and your server IP , try to reproduce the issue and share the PCAP.

to do this check page 569 userguide : User Guide for AsyncOS 14.0 for Cisco Web Security Appliances - GD (General Deployment)

Kindly note that I can not open the URL : https://webmail.austfoot.com.au from my computer and I get : ERR_CONNECTION_TIMED_OUT

also I can not resolve austfoot.com.au

thanks