Failed to deccrypt CP Site Response...

[LeeBingKang]

Hi all,

Have you ever faced this kind reason message as below? I tried to search SK but no SK related to this matter.

Thank you.

[LeeBingKang]

Attached error message at below

[G_W_Albrecht]

And what does the referred log tell you ?

[LeeBingKang]

This is what it tells.

[Chris_Atkinson]

Confirm with TAC that your case matches but I believe there is a hotfix for this issue.

[LeeBingKang]

I'm not really understand what is the meaning of "Confirm with TAC that your case matches".

Meanwhile, I tried to search the R80.40 jumbo hotfix with keyword "decrypt", but no fix show in the jumbo hotix.

[Chris_Atkinson]

Log a case with support and have them check your symptoms, if they match other similar cases there is potentially a private hotfix that will address it. Eventually that same fix may form part of a Jumbo.

[LeeBingKang]

Noted on it. Will open a TAC case for this matter once ready

[G_W_Albrecht]

So what is written in flow_2544_330697 ?

[LeeBingKang]

Haven't check it yet, but i will check it once having free time

[paolosint]

Can you share the solution if you find it? I have same logs in my Firewall.

[John_Fenoughty]

I have the same issue for a particular site. It's coming up a lot. My referred log had pages and pages of these:

rad_curl_task.cpp:214] CRadCurlTask::write_callback: [INFO] nmemb = 1448
[rad_curl_task.cpp:213] CRadCurlTask::write_callback: [INFO] enter to ...
[rad_curl_task.cpp:214] CRadCurlTask::write_callback: [INFO] nmemb = 1448

but then more interestingly has this:

[rad_decrypted_response_task.cpp:138] CRadDecryptedResponseTask::decrypt: [ERROR] response size is 1394880' limit to 1000000
[rad_decrypted_response_task.cpp:81] CRadDecryptedResponseTask::getResponseString: [ERROR] failed to decrypt response 0xefc34238
[rad_response_task.cpp:67] CRadResponseTask::run: [ERROR] can not get response string

We seem to be overrunning some sort of response size limit.

It's all happening for the same URL over and over, the URL is nothing special, it's just this: cs.mytheresa.com

[the_rock]

Does the log entry in smart console show actual name of the protection?

Andy

[John_Fenoughty]

Good question. So it first hits the HTTPS inspection blade, which tells us that this site's certificate is out of date. See 'bad cert' attached. The cert for the 'cs.mytheresa.com' in out of date, the cert on the main mytheresa.com site is fine.

Then the next thing is the Anti-Bot blade registers the 'Failed to decrypt CP Site Response' error.

I think I'll try putting in an override for the AB blade.

[the_rock]

Yep, cert is 100% valid, until March 10, 2024. I would also try add an exception first, good idea.

Andy

[Thomas_Eichelbu · Accepted solution]

Hello team!

we just had a very interesting call with TAC regarding this issue:

"[rad_decrypted_response_task.cpp:138] CRadDecryptedResponseTask::decrypt: [ERROR] response size is 1394880' limit to 1000000"

he said, Threat Clouds answer back to the RAD service is too large for the RAD service to handle!
Threat Cloud is constantly updating its indicator databases and this information is exceeding the 1000000 bytes limit on RAD.
and certain URL in Threat Cloud can contain alot more Indicators then other URL´s, so it means in future the 1000000 will be exceeding very likey on an everyday basis.
This value is also hardcoded in the RAD code, it required a hotfix.

This issue is already known, a Hotfix is available:
PMTR-97475 -> R82
PRJ-54192 -> R81.20
we installed and fixed in on top of R81.20 HFA 65

Also required is to empty the RAD cache via this GuiDBedit procedure "sk105179"
If answers from Threat Cloud are not fully loaded by RAD it can cause a chain of problems with web surfing.
this causes engine errors, https bypass error and many strange things.

[the_rock]

Interesting...

[PhoneBoy]

This sounds similar to the limit that existed in ioc_feeds in R81.10 and earlier.
This was fixed with new infrastructure (thus the ability to support 2 million+ IOC in R81.20).

[Henrik_Noerr1]

thank you for this! We see the same