cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
7659
Views
20
Helpful
14
Replies

HTTPS site fails to load

ashaw216
Beginner
Beginner

There are several HTTPS sites which, when we try to access them, give varying errors (Firefox "Secure Connection Failed", IE "Turn on TLS 1.0, TLS 1.1, and TLS 1.2 in Advanced settings and try connecting..." even though these are turned on, and Chrome "The webpage is not available ERR_CONNECTION_CLOSED").

 

Within the proxylog on the WSA170 I see these lines:

 

Warning: HTTPS : - : Unknown algorithm for public key in X509 certificate

 

 

When I run an SSL test against the site it says it supports TLS 1.0 - 1.2, but not SSL. I'm wondering why we're not able to connect.

14 Replies 14

Ken Stieers
VIP Advisor VIP Advisor
VIP Advisor

There are a couple of things that could be going on:

1. The current WSA versions don't support TLS 1.1 or 1.2.  TLS1.1/1.2 support is coming SOON.

2. there's a bug related to how the WSA tries to negotiate this, it will show up in the access logs as 502 errors for the site in question.  The fix for this is coming soon.

 

I ended up creating a custom category, setting it to "Pass-through" in the Decryption Access Policies"

 

Do we have any more indications when "SOON" will be? More and more sites are moving to TLS 1.1 / 1.2 and becoming inaccessible unless we bypass them (which opens us up to potential malware infection if the site becomes compromised.)

 

I'm honestly at a total loss how Cisco still doesn't support these protocols, which have been in use for YEARS.  TLS 1.1 in 2006 and TLS 1.2 in 2008 !!

I was in the beta, it exited a few weeks ago...I expect that FCS is imminent but don't have dates.

 

And yes Product Management knows they dropped the ball big time on this one...

Looking forward to the latest update. We are having a lot more issues with this lately.

Good Morning

Thanks for reaching out, Support for TLS 1.1 / 1.2 is available with the version 9.0.0-485 build (currently is limited deployment) provisioned based.  Please create a TAC case with the serial number of the Appliance needed to have this version provisioned.

 

Regards,

Zack

 

I currently have a TAC case open for our S680s.  Should the engineer be able to provision this version for us?  Having several incredibly frustrating issues including this.

Good Morning

 

That is correct, Please let your TAC engineer know and he/she will be able to have it provisioned.

 

Regards,

Zack

 

Our account manager has mentioned that this update may require a memory upgrade of the appliance (!) -- what are the requirements for it?

Their are some memory requirement for S370 (MUST be 8 Gig RAM),  Please have TAC engineer do the research for you and address all the concerns / questions you may have.

 

Thanks

Zack

 

Hi

I'd like to say we got 9.0.0-485 (S380) and our users can't access to https://www.ingdirect.es. In the browser we get ERR_CONNECTION_CLOSED. I downloaded pcap from our firewall and can see WSA sends to the remote server this:

TLSv1.2 Record Alert (Level: Fatal, Description: Unsupported Extension)

After it WSA sends a RST to ingdirect server.

I thought this problem was fixed in 9.0.0-485.

Regards

The site https://www.ingdirect.es loads fine for me, running 9.0.1-162.

Hi Erik

I read in another thread 9.0.0-485 didn't fix the TLS v1.2 issue. We have to schedule an upgrade to 9.0.1-162, I'm sure the issue will be fixed after upgrading.

Thanks for answering.

Good morning,

To me it happens the same for the website https://esta.cbp.dhs.gov/ I generate the error ERR_CONNECTION_CLOSED from the browser, in the capture of logs from the WSA I get error code 502:

1483558564.689 968 10.10.165.35 TCP_MISS / 502 0 TCP_CONNECT 216.81.87.20:443 - DIRECT / esta.cbp.dhs.gov - PASSTHRU_WEBCAT_7-INTERNETVIP-RedWifiRed0-NONE-NONE-NONE-DefaultGroup <IW_gov, 3.9, -, "-", IW_gov, -, "-", "-", "-", "-", "-", "-" "-" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" "" ""

This happens to the version of WSA 9.1.1-074, but in a WSA with version 8.5.2-027 I do not happen this type of error; Please can you inform me the root cause of this behavior and how can I solve it. Thank you in advance for your cooperation.

ashaw216
Beginner
Beginner

Problem solved:  we switched to Websense (now Forcepoint), which doesn't have this issue.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers