Https Inspection - Gemini

[paulocosta]

Hi,

We are experiencing a problem with the HTTPS inspection feature. I enabled a rule with an internal alert for users (UserPortal) to send categorization requests to the AI. All applications are working fine, but when users open Gemini, the browser connection is closed and does not work.

How can we solve this problem?

[Don_Paterson]

You have posted this thread in: CloudMates > Products > Cloud Network Security 

It looks like like a Harmony Endpoint question and should go in:  Products  > Workspace  > Endpoint

Or maybe: Network & SASE >  Security Gateways if it is a Quantum Security Gateway,

If you move it to the Endpoint forum space and add some more details about the policy (maybe also a screenshot of the policy) you might get more visibility and help.

[PhoneBoy]

Admins have to move posts, and I took care of that 🙂

[the_rock]

Can you please translate what error says? Looks like Portugese to me and only things I can speak in that language are thank you and number six lol

Andy

[Don_Paterson]

Seems to be:

"Secure Connection Failed

An error occurred during a connection to gemini.google.com. PR_END_OF_FILE_ERROR

Error code: PR_END_OF_FILE_ERROR

• The page you are trying to view cannot be displayed because the authenticity of the received data could not be verified.

• Please contact the website owners to inform them of this problem.

[Learn more...]

Try again"

Could be certificate pinning.

Gemini (Google) uses strict certificate pinning and advanced TLS (often TLS 1.3 + OCSP Must-Staple).

Need to add the URLs or domains to the “Bypass HTTPS Inspection” list.

Or

Browser doesn’t trust the gateway’s CA certificate. The HTTPS Inspection CA was not imported or trusted on the endpoint.

Will be good to know more about the problem.

I think the Endpoint in a screenshot is confusing things a bit. 

[the_rock]

Makes sense Don...bypass is always logical thing to try.

Andy

[PhoneBoy]

The only way to deal with Certificate Pinning is to bypass HTTPS Inspection for that site/service.
Not sure we have an Updatable Object (likely needed for this) or a list of URLs to bypass.
I do know R82 will handle Certificate Pinned sites much better as it will auto-bypass when this is detected.