logs regarding SSL Inspection

Options
Motivio
Motivio Posts: 21  Freshman Member
First Anniversary Friend Collector
in Security
What does the following log for SSL Inspection mean?

"SSL Inspection
Pass unsupported suite [server] connection. Rule_id:3"

and

"[client finished]Receive fatal alert message: desc = 48(unknown_ca) => Block/Reset SSL session!"

All Replies

  • Zyxel_Can
    Zyxel_Can Posts: 342  Zyxel Employee
    Friend Collector First Answer First Comment
    Options

    Hi @Motivio,

    When you create SSL inspection profile, there is an option for “Action for connection with unsupported suit”.

    In this case, that event was created because one of client visited a website that it doesn’t supported by your SSL inspection’s suit, because it was chosen as “pass” so traffic were passed without inspecting.

    "[client finished]Receive fatal alert message: desc = 48(unknown_ca) => Block/Reset SSL session!"

    This device connects to server but local didn’t trust CA. So it created this log output.

     

    Can you try to update your certificates?

     

    (Configuration > UTM Profile > SSL Inspection > Certificate Update > Update Now)

Categories

Security Highlight


Read more

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）