WSA : getting ERR_CERT_WEAK_SIGNATURE_ALGORITHM on google chrome and microsoft edge, wsa decryption policy

[Ismael10]

Hello All,

I'm geeting the following error ERR_CERT_WEAK_SIGNATURE_ALGORITHM when trying to reach HTTPS website.

Conditions : 

- Cisco WSA version : AsyncOS 11.5.1 build 125

- CA AD private root CA : Signature Hash Algorithm SHA256

- Https proxy : Decrypt All

- Access policies : Block

thank you in advance

[balaji.bandi]

Can you post the Logs while accessing the site to look at the full Log for the request?

[Ismael10]

Hi Baladji,

thank you for your response!

Find attached the log output of the request.

thank you!

[balaji.bandi]

Is this new setup or working one failing  - if new setup, re-visit htpts decryption config.

SSLVersionCallback: Invalid SSL version 0  - i see this error, worth looking below thread - make sure you followed correct steps for the Cert and other stuff

https://community.cisco.com/t5/web-security/wsa-s190-ssl-configuration-can-t-open-some-web-resourses/m-p/4107325

[Ismael10 · Accepted solution]

Hi Balaji,

thank you again for your feedback.

I found the solution, the issue is related to signature algorithm version, the AD issue a cert with a SHA-1. 

We change the version to SHA-256 in Cert Template from AD, reissue the cert using a new CSR (WSA).

Everything is working fine now.

[balaji.bandi]

Glad all working for you, we mark as resolve  and  it will benift for other community users.