Certificate Error on WSA

[Kanes Ramasamy]

Hi All,

I need some advise on the errors that I am getting when access www.news.google.com, the web page loads fine but the images on the website does not load. I believe the issue may be related to certificate. The url www.news.google.com uses the certificate *google.com but the images uses the certificate www.google.com and that seems to be the reason why the images are not loading. The images are fetched from https://t3.gstatic.com/ which is google's dedicated url for images,css and java. Please assist on how to fix this issue. 

Your help is much appreciated. 

Thanks and Regards,

Kanes.R

[Handy Putra]

Hi Kanes,

Would suggest 'grep' the accesslogs from the WSA CLI to see what destination or to see all the traffic being handled by WSA for news.google.com and what actions taken and go from there.

To grep the access logs for an entry, SSH into the WSA and run the following command from the CLI:
1. Grep
2. Enter the number of the log you wish to grep: 1 (for access logs)
3. Enter the regular expression to grep: <client IP>
4. Do you want this search to be case insensitive?: Y
5. Do you want to search for non-matching lines? [N]> N
6. Do you want to tail the logs?: Y
7. Do you want to paginate the output?: N

[Kanes Ramasamy]

Hi Handy,

Thanks for the guidance on the log collection and below is what i am seeing when the website that is not working is being accessed:

DECRYPT_ADMIN-INVALID_CERT_7

I believe there is a certificate issue but still not able to identify the fault. 

Any idea?

Regards,

Kanes.R

[Ken Stieers]

For some reason, sometimes the WSA has an issue with an intermediate cert/cert chain.  You can upload the intermediate and/or root to clear it up.

Go to the site using a browser that isn't behind the WSA.  Click on the lock in the address bar so it shows you the cert.  View the cert chain and save the intermediate and root certso as base64 files.  Go to the gui on the WSA, Network/Certificate Management/Manage Root Certs and upload these two certs.  

Once uploaded, check the On Cisco List column.  If it says yes you can delete that one...  submit/commit