Continuing issues with HTTPS decryption and website certificates

[dkorell]

I recently upgraded from 9.1.1 to 10.1.1 hoping that HTTPS websites would not display certificate and other errors as often as with 9.1.1. We have a lot of issues with websites displaying errors about certificates, websites not being trusted, websites won't load at all or will display errors about TLS versions, etc. Our decryption root certificate is on all domain computers and for at the last 4 websites I made URL bypass exclusions for their root cert is in the WSA already. Currently we are up to 75 URLs we are bypassing and we add at least one or two a week. Is this normal for others out there?

My concern is websites are getting more intelligent and blocking MITM attacks which of course is basically how the WSA is decrypting. I see HTTPS decryption almost becoming useless in the future.

[Ken Stieers]

No, this isn't normal. We don't have this issue.



What browsers are you using? On what OS?



What cipher string are you using? Ours might be a little permissive...

[dkorell]

Mostly IE 11 and Chrome. Some people use Firefox and the decryption cert is pushed to them since they don't use the Windows cert store. With these issues all browsers display some kind of error but the wording varies.

When I upgraded to 10.1.1 I changed the cipher to the following as recommeded in the release notes. Since upgrading to 10.1.1 about a week ago I've had to add 6 sites already to our bypass exclusion so neither the upgrade of cipher change seems to have made a difference.

[dkorell]

And previous to changing the ciphers with 10.1.1 they were "DEFAULT:+kEDH:!eNULL:!aNULL" and "DEFAULT:+kEDH:!eNULL". Not sure why my two WSAs were slightly different. I don't recall ever touching these from the original install default.