Introduction
This document describes common certificate and TLS protocol errors in the Umbrella Dashboard Activity Search.
Overview
HTTP traffic blocked due to certificate and TLS errors can now be viewed on the Umbrella Dashboard Activity Search. This article provides a list of common error messages as well as a brief explanation for each of the errors.
Certificate Errors
Upstream certificate expired
A certificate presented by the website has expired. Contact the webmaster of the site to report this issue.
Upstream certificate self-signed
The server certificate presented by the website is not signed by a Certificate Authority, and therefore Umbrella cannot determine if the certificate is trustworthy.
Self-signed certificates are sometimes used when a server hosts a resource which is intended for a restricted audience. For example, web portals for I.T. security appliances often default to using self-signed certificates. Umbrella cannot be configured to trust self-signed certificates.
Missing Intermediate Certificate
Umbrella was unable to obtain certificates for all Intermediate Authorities and therefore unable to validate the full chain of trust.
Web server certificates are typically issued/signed a Certificate Authority's intermediate certificate. Those intermediate certificates can also be issued by other intermediate certificates. The web server certificate (a.k.a. "leaf certificate") and any intermediate certificate(s) form a chain back to a root certificate. The website must bundle the intermediate certificate(s) with the server certificate in order for Umbrella to validate the full chain of trust. Contact the webmaster of the site to report this issue.
Alternatively if the certificate includes the “Authority Information Access” extension, Umbrella attempts to fetch the Intermediates CAs automatically. Note that Umbrella only supports the AIA extension when HTTPS Decryption and File Inspection are enabled.
Upstream certificate missing subject name.
The Subject field of the certificate does not contain a Distinguished Name (DN) to identify this certificate. This is a requirement for all certificates issued by a Certificate Authority, and therefore required by Cisco Umbrella. Contact the webmaster of the site to report this issue.
Upstream certificate missing common name.
The certificate presented by the website has no Common Name. The Common Name (CN) field is required by Umbrella SWG. This contains the certificate hostname, which is required to validate that the certificate matches the resource requested by the user (Eg. The address typed into the browser). Contact the webmaster of the site to report this issue.
Upstream certificate Untrusted
The Certificate is not trusted by Cisco Umbrella. This error typically means that Cisco does not trust the Root CA that issued the certificate.
Umbrella SWG has a built-in list of known trusted Root Certificate Authorities that we update from a reputable source. If the websites’ certificate is not signed by a CA on this list, the certificate validation fails. If you believe Umbrella is missing a Root CA which can be trusted, please contact technical support.
Hostname in cert is different from expected
The resource requested by the user (eg. the address typed into the browser) does not match the Common Name (CN) or Subject Alternative Name (SAN) of the certificate, therefore Umbrella cannot trust the certificate for this request. Contact the webmaster of the site to report this issue.
Upstream Certificate Revoked
The certificate provided by the website has been revoked by the issuing Certificate Authority.
Umbrella performs OCSP (Online Certificate Status Protocol) checks to determine if a certificate has been later revoked by a CA. Contact the webmaster of the site to report this issue.
TLS Handshake Errors
Unsupported Upstream Cipher
The TLS handshake could not be completed. This typically means the website does not support any of the list of Cipher Suites used by Umbrella SWG. This error can occur with older or outdated webservers that only support weaker TLS ciphers. Contact the webmaster of the site to report this issue.
Upstream TLS Version Mismatch
The TLS handshake could not be completed because the website does not support the same TLS version that Umbrella SWG uses. At the moment, Umbrella SWG Proxy supports TLS 1.2 and TLS 1.3 on both the client side connections to Umbrella SWG and also from Umbrella SWG proxy connections to destination web servers.
Upstream DH key less than 1024 bits
The TLS handshake could not be completed because the website uses a weak Diffie-Hellman key that is not supported by Umbrella. Contact the webmaster of the site to report this issue.
Workarounds
It is possible to workaround these issues by making configuration changes in Cisco Umbrella. This must only be done if you trust the authenticity of the server and certificate.
Workarounds can be applied using a "Selective Decryption List" entry to disable decryption or an "External Domains" entry to bypass the traffic from Umbrella entirely. Umbrella does not perform certificate validation when decryption is disabled. Be aware that in the majority of cases the browser still presents an error or warning when the traffic is bypassed from Umbrella - Web browsers perform similar certificate validation.
Feedback