topic "Decryption error" in Network Security

"Decryption error"

ashaw216 — Fri, 21 Feb 2020 15:38:44 GMT

Running FP 8130 appliances, within FP Management we are seeing "Decryption Error" for port 443 traffic. We have a valid root cert for the MtM decryption process. Where can we find more information about WHY this has a "Decryption Error"?

Re: "Decryption error"

yogdhanu — Wed, 18 Apr 2018 12:22:34 GMT

What's the version of firmware running and exact error?

Are you using decrypt resign or decrypt with known key?

Thanks

Yogesh

Re: "Decryption error"

ashaw216 — Wed, 18 Apr 2018 13:33:13 GMT

6.1.0, under SSL Status it says "Do Not Decrypt (Decryption Error)"

We are using Decrypt - Resign.

Re: "Decryption error"

yogdhanu — Thu, 19 Apr 2018 10:29:35 GMT

You can try using this command on the sensor CLI

system support ssl-client-hello-tuning extensions_remove 16,13172

This would make sure some extensions which are not supported on firepower are removed from client hello.

The error details need be found using SSL debugs which would require TAC case.

Hope it helps,

yogesh