WSA S000v HTTPS proxy : TLS session reset from WSA

[giovanni.augusto]

Hi Everyone,

I am running a test on a WSA and I am unable to make HTTPS proxy to work at the moment, I can see in wireshark from a packet capture on the wire that the WSA is actively closing the TCP session and I receive an error message that is not generated by the WSA but rather than the windows client browser, HTTP instead works fine.

I indeed tried with several flavor of certificates, in order :

• local WSA self-singed certificate
• local WSA certificate signed by internal root CA
• uploaded internal root CA certificate and key

I installed all those certificates into the user and computer workstation's

• Trusted Root Certification autorities
• intermediate Root certification authorities

I tried disabling/enabling all TLS and SSL versions and I tried modifying the chipers on the WSA appliance

Let me show you here below

WSA ip : 192.168.2.162

Workstation ip : 10.1.128.2

HTTPS TCP session reset actively from the WSA

On the browser:

 Additionally I am also seeing these logs on the appliance from https_logs:

Mon Oct 15 14:02:32 2018 Debug: HTTPS : - : DIAG: client did not complete SSL Handshake
Mon Oct 15 14:02:32 2018 Debug: HTTPS : - : error:1407609B:SSL routines:SSL23_GET_CLIENT_HELLO:https proxy request
Mon Oct 15 14:02:32 2018 Trace: HTTPS : - : Error Function is: 118 Error Reason is:155

[balaji.bandi]

Look at the requirements :

https://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/117792-technote-wsa-00.html

[balaji.bandi]

For your reference to start with good video.

https://www.youtube.com/watch?v=2R12y5qRF4Y

[giovanni.augusto]

Thanks but this is one of the reference I watched already but with no benefit, what I can see is that the TLS/SSL session is no even established between the WSA and the client and I tried with several browsers and several clients.

the paket capture I ran shows actually that the session is initiated by the client and immediately reset by the WSA producing the logs I showed 

[giovanni.augusto · Accepted solution]

In the end it was simply a misunderstanding on my end:

I used the HTTPS proxy configured port also in the windows and browser client settings for HTTPS proxy traffic, instead the proxy port for HTTPS has to be the same as HTTP traffic.