- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ERR_SSL_PROTOCOL_ERROR on the newest Chrome 131
Hi,
we have such problem on every webpages with the newest chrome version 131 error appears:
ERR_SSL_PROTOCOL_ERROR
as I read Chrome implemented any new TLS mechanism in this version:
https://chromestatus.com/feature/5257822742249472
is any solution for this?
- Labels:
-
FortiGate
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Same problem here since today. If we turn of SSL deep inspection, we have no problem. But that is not a good solution.
No problems with other browsers
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on some initial tests:
proxy-mode inspection seems to work (tested 7.6.0).
Flow-mode has problems. This will need a new IPS engine release.
As a workaround you can go to chrome://flags, and disable the post-quantum feature flags:
#enable-tls13-kyber
#use-ml-kem
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ya indeed,
getting more and more tickets from my clients that this happens.
I've read that post-quantum was enabled by google in Chrome 124 already.
I am going to perform some testing in FOS 7.2 to see if it works in proxy mode.
I also opened a ticket with TAC on this.
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes I can now confirm: also in FOS 7.2:
TLSv1.3 broken with DPI in flow mode
TLSv1.3 works with DPI in proxy mode (policy + security profile group + filter profiles)
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
humm my TAC ticket has escalated to a senior within 15mins ;)
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well, that escalated quickly.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I believe the switch from Kyber to ML-KEM is what is causing the issue. Chrome 131 switched post-quantum key agreement from Kyber to ML-KEM. Disabling the flag via GPO is what we ended up doing at our org until FortiOS 7.2.x supports ML-KEM.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This resolved the issue for us
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This link has some details on this: https://chromestatus.com/feature/5257822742249472
Accoarding to this disabling the Flag is not a solution because its going to be removed at all with chrome v141. Then you GPO will no longer work.
--
"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
