topic Re: Failed to deccrypt CP Site Response... in General Topics

Failed to deccrypt CP Site Response...

LeeBingKang — Tue, 19 Dec 2023 09:16:54 GMT

Hi all,

Have you ever faced this kind reason message as below? I tried to search SK but no SK related to this matter.

Thank you.

Re: Failed to deccrypt CP Site Response...

LeeBingKang — Tue, 19 Dec 2023 09:17:54 GMT

Attached error message at below

Re: Failed to deccrypt CP Site Response...

G_W_Albrecht — Tue, 19 Dec 2023 11:27:31 GMT

And what does the referred log tell you ?

Re: Failed to deccrypt CP Site Response...

LeeBingKang — Tue, 19 Dec 2023 11:44:52 GMT

This is what it tells.

Re: Failed to deccrypt CP Site Response...

Chris_Atkinson — Tue, 19 Dec 2023 12:19:06 GMT

Confirm with TAC that your case matches but I believe there is a hotfix for this issue.

Re: Failed to deccrypt CP Site Response...

LeeBingKang — Tue, 19 Dec 2023 13:35:14 GMT

I'm not really understand what is the meaning of "Confirm with TAC that your case matches".

Meanwhile, I tried to search the R80.40 jumbo hotfix with keyword "decrypt", but no fix show in the jumbo hotix.

Re: Failed to deccrypt CP Site Response...

G_W_Albrecht — Tue, 19 Dec 2023 14:45:15 GMT

So what is written in flow_2544_330697 ?

Re: Failed to deccrypt CP Site Response...

Chris_Atkinson — Tue, 19 Dec 2023 15:39:52 GMT

Log a case with support and have them check your symptoms, if they match other similar cases there is potentially a private hotfix that will address it. Eventually that same fix may form part of a Jumbo.

Re: Failed to deccrypt CP Site Response...

LeeBingKang — Wed, 20 Dec 2023 02:45:24 GMT

Haven't check it yet, but i will check it once having free time

Re: Failed to deccrypt CP Site Response...

LeeBingKang — Wed, 20 Dec 2023 02:46:00 GMT

Noted on it. Will open a TAC case for this matter once ready

Re: Failed to deccrypt CP Site Response...

paolosint — Thu, 21 Dec 2023 17:00:28 GMT

Can you share the solution if you find it? I have same logs in my Firewall.

Re: Failed to deccrypt CP Site Response...

John_Fenoughty — Thu, 11 Jan 2024 17:51:28 GMT

I have the same issue for a particular site. It's coming up a lot. My referred log had pages and pages of these:

rad_curl_task.cpp:214] CRadCurlTask::write_callback: [INFO] nmemb = 1448
[rad_curl_task.cpp:213] CRadCurlTask::write_callback: [INFO] enter to ...
[rad_curl_task.cpp:214] CRadCurlTask::write_callback: [INFO] nmemb = 1448

but then more interestingly has this:

[rad_decrypted_response_task.cpp:138] CRadDecryptedResponseTask::decrypt: [ERROR] response size is 1394880' limit to 1000000
[rad_decrypted_response_task.cpp:81] CRadDecryptedResponseTask::getResponseString: [ERROR] failed to decrypt response 0xefc34238
[rad_response_task.cpp:67] CRadResponseTask::run: [ERROR] can not get response string

We seem to be overrunning some sort of response size limit.

It's all happening for the same URL over and over, the URL is nothing special, it's just this: cs.mytheresa.com

Re: Failed to deccrypt CP Site Response...

the_rock — Thu, 11 Jan 2024 18:32:18 GMT

Does the log entry in smart console show actual name of the protection?

Andy

Re: Failed to deccrypt CP Site Response...

John_Fenoughty — Thu, 11 Jan 2024 18:55:51 GMT

Good question. So it first hits the HTTPS inspection blade, which tells us that this site's certificate is out of date. See 'bad cert' attached. The cert for the 'cs.mytheresa.com' in out of date, the cert on the main mytheresa.com site is fine.

Then the next thing is the Anti-Bot blade registers the 'Failed to decrypt CP Site Response' error.

I think I'll try putting in an override for the AB blade.

Re: Failed to deccrypt CP Site Response...

the_rock — Thu, 11 Jan 2024 19:01:12 GMT

Yep, cert is 100% valid, until March 10, 2024. I would also try add an exception first, good idea.

Andy

Re: Failed to deccrypt CP Site Response...

Thomas_Eichelbu — Thu, 20 Jun 2024 09:12:19 GMT

Hello team!

we just had a very interesting call with TAC regarding this issue:

"[rad_decrypted_response_task.cpp:138] CRadDecryptedResponseTask::decrypt: [ERROR] response size is 1394880' limit to 1000000"

he said, Threat Clouds answer back to the RAD service is too large for the RAD service to handle!
Threat Cloud is constantly updating its indicator databases and this information is exceeding the 1000000 bytes limit on RAD.
and certain URL in Threat Cloud can contain alot more Indicators then other URL´s, so it means in future the 1000000 will be exceeding very likey on an everyday basis.
This value is also hardcoded in the RAD code, it required a hotfix.

This issue is already known, a Hotfix is available:
PMTR-97475 -> R82
PRJ-54192 -> R81.20
we installed and fixed in on top of R81.20 HFA 65

Also required is to empty the RAD cache via this GuiDBedit procedure "sk105179"
If answers from Threat Cloud are not fully loaded by RAD it can cause a chain of problems with web surfing.
this causes engine errors, https bypass error and many strange things.

Re: Failed to deccrypt CP Site Response...

the_rock — Thu, 20 Jun 2024 10:55:02 GMT

Interesting...

Re: Failed to deccrypt CP Site Response...

PhoneBoy — Thu, 20 Jun 2024 19:28:47 GMT

This sounds similar to the limit that existed in ioc_feeds in R81.10 and earlier.
This was fixed with new infrastructure (thus the ability to support 2 million+ IOC in R81.20).

Re: Failed to deccrypt CP Site Response...

Henrik_Noerr1 — Tue, 09 Jul 2024 10:11:28 GMT

thank you for this! We see the same

Re: Failed to deccrypt CP Site Response...

Thomas_Eichelbu — Fri, 11 Oct 2024 09:05:12 GMT

Hello team,

this is now fixed in R81.20 HFA 89

PRHF-36617/PRJ-54192 (Antibot error: Failed to Decrypt CP Site Response)

PRJ-54192

PRHF-31001

Anti-Bot

The Anti-Bot Blade may generate error logs with the "Failed to Decrypt CP Site Response" reason. Refer to sk182494.