Forum Discussion
Noom_39572
Nimbostratus
Nimbostratushttps not working with http profile
I have a strange issue with http profile. My version is 10.2.2. We have VIPs that use SSL client to de-encrypted and SSL Server to re-encrypted to backend servers. also http profile were used for iRu...
Kevin_Stewart
Employee
EmployeeExpanded for readability:
New TCP connection 1: 10.1.1.x(53963) <-> 10.13.10.x(443)
1 1 0.1468 (0.1468) C>S Handshake
ClientHello
Version 3.3
cipher suites
Unknown value 0xc00a
Unknown value 0xc014
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Unknown value 0x6b
TLS_RSA_WITH_AES_256_CBC_SHA
Unknown value 0x3d
Unknown value 0xc007
Unknown value 0xc009
Unknown value 0xc023
Unknown value 0xc011
Unknown value 0xc013
Unknown value 0xc027
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_DSS_WITH_NULL_SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_RSA_WITH_AES_128_CBC_SHA
Unknown value 0x3c
TLS_RSA_WITH_3DES_EDE_CBC_SHA
compression methods NULL
1 2 0.1468 (0.0000) S>C Handshake
ServerHello
Version 3.1
session_id[32]=
2b 92 da 9e d0 37 46 32 a9 97 92 8e 77 12 68 96
82 41 cc b5 1f 23 77 d5 66 b3 0e 41 23 03 a7 a2
cipherSuite
TLS_RSA_WITH_RC4_128_SHA
compressionMethod NULL
1 3 0.2942 (0.1473) S>C Handshake
Certificate
1 4 0.2942 (0.0000) S>C Handshake
ServerHelloDone
1 5 0.4452 (0.1509) C>S Handshake
ClientKeyExchange
1 6 0.4452 (0.0000) C>S ChangeCipherSpec
1 7 0.4452 (0.0000) C>S Handshake
1 8 0.4482 (0.0029) S>C ChangeCipherSpec
1 9 0.4482 (0.0000) S>C Handshake
1 10 0.6744 (0.2262) C>S application_data
1 0.8723 (0.1978) S>C TCP RST
Is this a client side or a server side capture? The listed cipher suites makes me think this is a client side capture. Please verify that you're listening on the correct interface and use the IIS8 server's private key to decrypt the data.
