"Decryption error"

[ashaw216]

Running FP 8130 appliances, within FP Management we are seeing "Decryption Error" for port 443 traffic. We have a valid root cert for the MtM decryption process. Where can we find more information about WHY this has a "Decryption Error"?

[yogdhanu]

Hi

What's the version of firmware running and exact error?

Are you using decrypt resign or decrypt with known key?

Thanks

Yogesh

[ashaw216]

6.1.0, under SSL Status it says "Do Not Decrypt (Decryption Error)"

We are using Decrypt - Resign.

[yogdhanu]

Hi

You can try using this command on the sensor CLI

system support ssl-client-hello-tuning extensions_remove 16,13172

This would make sure some extensions which are not supported on firepower are removed from client hello.

The error details need be found using SSL debugs which would require TAC case.

Hope it helps,

yogesh