cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
662
Views
0
Helpful
3
Replies
Beginner

Continuing issues with HTTPS decryption and website certificates

I recently upgraded from 9.1.1 to 10.1.1 hoping that HTTPS websites would not display certificate and other errors as often as with 9.1.1. We have a lot of issues with websites displaying errors about certificates, websites not being trusted, websites won't load at all or will display errors about TLS versions, etc. Our decryption root certificate is on all domain computers and for at the last 4 websites I made URL bypass exclusions for their root cert is in the WSA already. Currently we are up to 75 URLs we are bypassing and we add at least one or two a week. Is this normal for others out there?

My concern is websites are getting more intelligent and blocking MITM attacks which of course is basically how the WSA is decrypting. I see HTTPS decryption almost becoming useless in the future.

3 REPLIES 3
Collaborator

Re: Continuing issues with HTTPS decryption and website certificates

No, this isn't normal. We don't have this issue.



What browsers are you using? On what OS?



What cipher string are you using? Ours might be a little permissive...






Beginner

Re: Continuing issues with HTTPS decryption and website certificates

Mostly IE 11 and Chrome. Some people use Firefox and the decryption cert is pushed to them since they don't use the Windows cert store. With these issues all browsers display some kind of error but the wording varies.

 

When I upgraded to 10.1.1 I changed the cipher to the following as recommeded in the release notes. Since upgrading to 10.1.1 about a week ago I've had to add 6 sites already to our bypass exclusion so neither the upgrade of cipher change seems to have made a difference.

 

 

Capture.PNG

Highlighted
Beginner

Re: Continuing issues with HTTPS decryption and website certificates

And previous to changing the ciphers with 10.1.1 they were "DEFAULT:+kEDH:!eNULL:!aNULL" and "DEFAULT:+kEDH:!eNULL". Not sure why my two WSAs were slightly different. I don't recall ever touching these from the original install default.