08-30-2017 09:54 AM - edited 03-08-2019 07:41 PM
I recently upgraded from 9.1.1 to 10.1.1 hoping that HTTPS websites would not display certificate and other errors as often as with 9.1.1. We have a lot of issues with websites displaying errors about certificates, websites not being trusted, websites won't load at all or will display errors about TLS versions, etc. Our decryption root certificate is on all domain computers and for at the last 4 websites I made URL bypass exclusions for their root cert is in the WSA already. Currently we are up to 75 URLs we are bypassing and we add at least one or two a week. Is this normal for others out there?
My concern is websites are getting more intelligent and blocking MITM attacks which of course is basically how the WSA is decrypting. I see HTTPS decryption almost becoming useless in the future.
08-30-2017 10:09 AM
08-30-2017 10:18 AM
Mostly IE 11 and Chrome. Some people use Firefox and the decryption cert is pushed to them since they don't use the Windows cert store. With these issues all browsers display some kind of error but the wording varies.
When I upgraded to 10.1.1 I changed the cipher to the following as recommeded in the release notes. Since upgrading to 10.1.1 about a week ago I've had to add 6 sites already to our bypass exclusion so neither the upgrade of cipher change seems to have made a difference.
08-30-2017 10:28 AM
And previous to changing the ciphers with 10.1.1 they were "DEFAULT:+kEDH:!eNULL:!aNULL" and "DEFAULT:+kEDH:!eNULL". Not sure why my two WSAs were slightly different. I don't recall ever touching these from the original install default.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide