topic Re: SSL Decryption unsupported cipher suite in Network Security

SSL Decryption unsupported cipher suite

lupingyao — Tue, 12 Mar 2019 13:59:43 GMT

Hi,

We have a FTD and want to use SSL Decryption to protect my Exchange Server from outside, but after I configure the SSL Decryption, I got the Error Message: " not decrypt unsupported cipher suite", how can I find which cipher Suite not work? is there any command in FTD to find out?

Regards

Robin

Re: SSL Decryption unsupported cipher suite

Marvin Rhoads — Wed, 26 Sep 2018 10:20:24 GMT

There is a listing in the configuration guide.

Look here:

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/decryption_tuning_using_ssl_rules.html#ID-2255-000006c2

..and search for "Cipher Suite SSL Rule Conditions"

Re: SSL Decryption unsupported cipher suite

lupingyao — Wed, 26 Sep 2018 12:33:32 GMT

Hi Marvin,

thanks for your answer!
I dont need build the Rule condition, i use "any", still got "unsupported cipher suite", so i would like to find which one from my exchange Server is "unsupported cipher suite", how can I find ? is there any show in lina CLI? Than I can disable in my Exchange Server...

regards

Robin

Re: SSL Decryption unsupported cipher suite

Marvin Rhoads — Wed, 26 Sep 2018 15:25:57 GMT

You might be able to discern it from one of the more verbose debug commands.

However I'd suggest doing a packet capture instead. Wireshark is pretty good at showing you an SSL/TLS negotiation failure.