Google Abandoned

[skearton]

Is anyone else seeing abandoned Google sessions today?

All other search engines and https sites appear to work fine.

Just started today from what I can tell.


SSL inspector says it's using rule 0 for google, but my inspect google rule is ID 10.

I don't have a rule ID 0. Am I trying to inspect Google incorrectly?

Still working on this too. Will edit as I go.

ERR_Connection_Closed shows in the client browser.

[skearton]

Chrome, Edge, and Firefox face the same issue. Disabling ssl inspector allows Google to work, but when re-enabled Google is disabled again, even if I untick the "Inspect Google" that I had created.

My root cert is still working fine with other ssl sites. Only getting rejected by google.

ssl inspect.PNG

cert abandoned.PNG

[skearton]

untangle request.PNG

untangle request2.PNG


I've tried switching to SSL: Cert Issuer and SSL: Cert subject rather than SNI

I still see abandoned, rule 0 no matter which way I switch it around.

Disabling SSL inspector allows google to work properly.

[dmorris]

You will need to look at the cert coming from that IP.
You can do so in chrome or with a variety of tools.
If the cert is from google it should be accepted, if its from someone else something funky is going on...

abandoned means that SSL inspector abandoned the session because it did not trust the certificate presented from the server.

[skearton]

unt req3.PNG

unt tls.PNG

unt4.PNG

unt5.PNG

When SSL inspector is off, the google cert looks to be normal. Is that what you mean?

Thank you for your assistance.

[dmorris]

run this on untangle:
echo | openssl s_client -showcerts -connect 172.217.6.110:443 2>|/dev/null | openssl x509 -inform pem -noout -text

[skearton]

cert output.txt

[skearton]

Do I need to have an "Ignore all other traffic, or block all other traffic" enabled? Is it mandatory, and maybe I unticked it at some point?

[skearton]

I've verified that the CA for untangle is present in

ConsoleRoot\Certificates\(local computer)TrustedRootAuthorities\Certificates

[bluechris]

I don't have ssl inspector enabled in company but something strange is happening since yesterday because in work the last 2 days i got in all the terminals of my users (25) popups to allow our not allow connections to Google from eset. I haven't figured why and after too much ball breaking in phones i ended up to configure all the eset installations to never ask and always block the suspicious site from Google.
It was something from adservices from Google i think but even after the block all working fine.