Failed to deccrypt CP Site Response...

[LeeBingKang]

Hi all,

Have you ever faced this kind reason message as below? I tried to search SK but no SK related to this matter.

Thank you.

[LeeBingKang]

Attached error message at below

[G_W_Albrecht]

And what does the referred log tell you ?

[LeeBingKang]

This is what it tells.

[Chris_Atkinson]

Confirm with TAC that your case matches but I believe there is a hotfix for this issue.

[LeeBingKang]

I'm not really understand what is the meaning of "Confirm with TAC that your case matches".

Meanwhile, I tried to search the R80.40 jumbo hotfix with keyword "decrypt", but no fix show in the jumbo hotix.

[Chris_Atkinson]

Log a case with support and have them check your symptoms, if they match other similar cases there is potentially a private hotfix that will address it. Eventually that same fix may form part of a Jumbo.

[LeeBingKang]

Noted on it. Will open a TAC case for this matter once ready

[G_W_Albrecht]

So what is written in flow_2544_330697 ?

[LeeBingKang]

Haven't check it yet, but i will check it once having free time

[paolosint]

Can you share the solution if you find it? I have same logs in my Firewall.

[John_Fenoughty]

I have the same issue for a particular site. It's coming up a lot. My referred log had pages and pages of these:

rad_curl_task.cpp:214] CRadCurlTask::write_callback: [INFO] nmemb = 1448
[rad_curl_task.cpp:213] CRadCurlTask::write_callback: [INFO] enter to ...
[rad_curl_task.cpp:214] CRadCurlTask::write_callback: [INFO] nmemb = 1448

but then more interestingly has this:

[rad_decrypted_response_task.cpp:138] CRadDecryptedResponseTask::decrypt: [ERROR] response size is 1394880' limit to 1000000
[rad_decrypted_response_task.cpp:81] CRadDecryptedResponseTask::getResponseString: [ERROR] failed to decrypt response 0xefc34238
[rad_response_task.cpp:67] CRadResponseTask::run: [ERROR] can not get response string

We seem to be overrunning some sort of response size limit.

It's all happening for the same URL over and over, the URL is nothing special, it's just this: cs.mytheresa.com

[the_rock]

Does the log entry in smart console show actual name of the protection?

Andy

[John_Fenoughty]

Good question. So it first hits the HTTPS inspection blade, which tells us that this site's certificate is out of date. See 'bad cert' attached. The cert for the 'cs.mytheresa.com' in out of date, the cert on the main mytheresa.com site is fine.

Then the next thing is the Anti-Bot blade registers the 'Failed to decrypt CP Site Response' error.

I think I'll try putting in an override for the AB blade.

[the_rock]

Yep, cert is 100% valid, until March 10, 2024. I would also try add an exception first, good idea.

Andy