Forum Discussion

Noom_39572's avatar
Noom_39572
Icon for Nimbostratus rankNimbostratus
Oct 21, 2013

https not working with http profile

I have a strange issue with http profile. My version is 10.2.2. We have VIPs that use SSL client to de-encrypted and SSL Server to re-encrypted to backend servers. also http profile were used for iRu...
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 22, 2013

Expanded for readability:

New TCP connection 1: 10.1.1.x(53963) <-> 10.13.10.x(443) 
1 1 0.1468 (0.1468) C>S Handshake 
    ClientHello 
    Version 3.3 
    cipher suites 
        Unknown value 0xc00a 
        Unknown value 0xc014 
        TLS_DHE_RSA_WITH_AES_256_CBC_SHA 
        Unknown value 0x6b 
        TLS_RSA_WITH_AES_256_CBC_SHA 
        Unknown value 0x3d 
        Unknown value 0xc007 
        Unknown value 0xc009 
        Unknown value 0xc023 
        Unknown value 0xc011 
        Unknown value 0xc013 
        Unknown value 0xc027 
        TLS_DHE_RSA_WITH_AES_128_CBC_SHA 
        TLS_DHE_DSS_WITH_NULL_SHA 
        TLS_DHE_DSS_WITH_AES_128_CBC_SHA 
        TLS_RSA_WITH_RC4_128_SHA 
        TLS_RSA_WITH_RC4_128_MD5 
        TLS_RSA_WITH_AES_128_CBC_SHA 
        Unknown value 0x3c 
        TLS_RSA_WITH_3DES_EDE_CBC_SHA 
    compression methods NULL 
1 2 0.1468 (0.0000) S>C Handshake 
    ServerHello 
    Version 3.1 
    session_id[32]= 
        2b 92 da 9e d0 37 46 32 a9 97 92 8e 77 12 68 96 
        82 41 cc b5 1f 23 77 d5 66 b3 0e 41 23 03 a7 a2 
    cipherSuite 
        TLS_RSA_WITH_RC4_128_SHA 
    compressionMethod NULL 
1 3 0.2942 (0.1473) S>C Handshake 
    Certificate 
1 4 0.2942 (0.0000) S>C Handshake 
    ServerHelloDone 
1 5 0.4452 (0.1509) C>S Handshake 
    ClientKeyExchange 
1 6 0.4452 (0.0000) C>S ChangeCipherSpec 
1 7 0.4452 (0.0000) C>S Handshake 
1 8 0.4482 (0.0029) S>C ChangeCipherSpec 
1 9 0.4482 (0.0000) S>C Handshake 
1 10 0.6744 (0.2262) C>S application_data 
1 0.8723 (0.1978) S>C TCP RST

Is this a client side or a server side capture? The listed cipher suites makes me think this is a client side capture. Please verify that you're listening on the correct interface and use the IIS8 server's private key to decrypt the data.