https error on websites

[andrei.goutnik]

I am having an issue with Cisco Web Security Appliance (S380), accessing https websites.

Specifically when trying to access our webmail website i get an error "ERR_SSL_PROTOCOL_ERROR" when running through the Cisco WSA. 

The website is https://webmail.austfoot.com.au we have a SSL certificate from DigiCert and i have added the *.austfoot.com.au domain to be bypassed in WSA however i still get the error.

Works fine if not going through the WSA.

It used to work fine, however the Appliance was updated to the latest update and now it has stopped working. I thought i just needed to load the certificate into "Certificate Management" under trusted root, however that didnt work.

[David Niemann]

Can you post some of the logs from the access logs when the site is accessed?

[andrei.goutnik]

Would it be the following?

1483928012.640 1 10.1.1.59 TCP_MISS/502 39 CONNECT tunnel://webmail.austfoot.com.au:443/ - DIRECT/webmail.austfoot.com.au - PASSTHRU_WEBCAT_7-DefaultGroup-AFL_Active_Directory-NONE-NONE-NONE-DefaultGroup <IW_sprt,0.0,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_sprt,-,"-","-","Unknown","Unknown","-","-",312.00,0,-,"-","-",-,"-",-,-,"-","-"> -
1483928012.645 4 10.1.1.59 TCP_MISS/502 39 CONNECT tunnel://webmail.austfoot.com.au:443/ - DIRECT/webmail.austfoot.com.au - PASSTHRU_WEBCAT_7-DefaultGroup-AFL_Active_Directory-NONE-NONE-NONE-DefaultGroup <IW_sprt,0.0,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_sprt,-,"-","-","Unknown","Unknown","-","-",78.00,0,-,"-","-",-,"-",-,-,"-","-"> -

[shgrover]

Hello andrei.goutnik,

The domain you have mentioned is not being bypassed. I think you added ".austfoot.com.au" to the bypass settings on the WSA when you says you have bypassed it however you have an explicit setup ( either PAC file, Hostname/Ip of the WSA in the browser). Bypass settings on the WSA work only with the Transparent setup (wccp). Please bypass this domain on the PAC file or on the browser it self. you cannot bypass it on the WSA. you can try to make a custom url category also and allow /passthrough it in access/decryption policy and check if it works. If it doesn't then you have bypass it for sure. 

Regards

Shikha Grover

PS: Please don't forget to rate and select as validated answer if this answered your question

[amojarra]

Hi @andrei.goutnik 

I can see HTTP 502 from your accesslog which is Bad gateway. 

If you done the steps @shgrover  mentioned and still get 502 from accesslogs, could you please capture packet from WSA filter for your client IP and your server IP , try to reproduce the issue and share the PCAP.

to do this check page 569 userguide : User Guide for AsyncOS 14.0 for Cisco Web Security Appliances - GD (General Deployment)

Kindly note that I can not open the URL : https://webmail.austfoot.com.au from my computer and I get : ERR_CONNECTION_TIMED_OUT

also I can not resolve austfoot.com.au 

thanks  

[Ravi Singh]

You are getting this error only for this URL or whenever you are accessing any https site?

In Some cases, SSL state may blok your connection and show you this error. Try to clear SSL state

[andrei.goutnik]

Hi Ravi,

Thanks for the reply.

It seems to be happening with all sites that I access under the .austfoot.com.au domain. 

Another example is https://connx.austfoot.com.au as soon as I go through the WSA I get the SSL error.

[jonianggara65839]

pertanyaan saya yang ingin saya tanyakan karena kasus yang saya alami hampir sama di ip menuju website Pekalongan news

[jameslehner992]

I cant visit half of the website on the internet. The connection is not sure on half of the websites. Anyone know the solution to this?

[amojarra]

@jameslehner992 

kindly share with us more details about your issue.

you can brows some https and can not brose some https site ( approximately 50%-50%) 

if so please share the output of sslconfig > versions from CLI and some lines of access logs from blocked URLs and allowed URLs