SSL Decryption fails for certain HTTPS sites with error: ERR_SSL_PROTOCOL_ERROR ;client hs_type 0

1. Client machine pcap
2. All four stages on the firewall involved with decryption
3. Flow Basic
4. SSL Basic
5. Proxy Basic

Workaround:
Create a decryption exception for the HTTPS sites that fail due to SSL renegotiation.

1. Policy-Based Exclusions

Use this method for traffic you choose not to decrypt, such as financial, healthcare, or executive traffic

• Create a "No Decrypt" Rule: Navigate to Policies > Decryption and add a new rule. Set the Action to No Decrypt
• Define Match Criteria: You can exclude traffic based on:
  • URL Categories: Add predefined categories like financial-services or health-and-medicine
  • Source/Destination: Exclude specific source IP addresses (e.g., for executives) or destination servers (e.g., finance servers)
  • External Dynamic Lists (EDL): Use EDLs for dynamically changing environments like Office 365
• Apply a No-Decryption Profile: (Best Practice) Attach a decryption profile to the rule to continue checking for expired certificates or untrusted issuers, even if the traffic isn't decrypted
• Rule Order: Place exclusion rules at the top of your decryption rulebase to ensure they are evaluated before more general decryption rules

2. SSL Decryption Exclusion List

• Predefined Exclusions: Palo Alto Networks maintains a list of commonly known sites that break decryption. You can view these under Device > Certificate Management > SSL Decryption Exclusions
• Custom Exclusions: If a site is not in the predefined list, add it manually:
    1. Go to Device > Certificate Management > SSL Decryption Exclusions
    2. Click Add and enter the Hostname (e.g., *.example.com). Wildcards are supported
    3. Commit your changes
  

3. GlobalProtect Split Tunneling

If you are using Prisma Access or GlobalProtect, you can exclude traffic from the VPN tunnel entirely using Split Tunneling. This is often used for high-bandwidth, low-risk traffic like video streaming

• Navigate to the GlobalProtect Gateway > Agent > Client Settings > Split Tunnel
• Add specific domains or IP subnets to the Exclude list

2019-12-13 04:14:37.418 -0800 debug: pan_ssl3_process_handshake_msg(pan_ssl3.c:1039): unexpected message client hs_type 0 <<<
2019-12-13 04:14:37.418 -0800 Error: pan_ssl_proxy_handle_rt_hs(pan_ssl_proxy.c:242): pan_ssl3_process_handshake_msg() failed -1
2019-12-13 04:14:37.418 -0800 Error: pan_ssl_proxy_parse_data(pan_ssl_proxy.c:610): pan_ssl_parse_record() failed 192.168.54.10[57615]-->104.47.28.22[443] <<<<<<<
2019-12-13 04:14:37.418 -0800 pan_proxy_handle_error(pan_proxy.c:2118): handle error -1
2019-12-13 04:14:37.418 -0800 debug: pan_proxy_ssl_check_block_error(pan_proxy.c:2102): In session(7846), encounters error_id(-1 PAN_SSL_ERROR_GENERAL), action: skip <<<<<<<
2019-12-13 04:14:37.418 -0800 debug: pan_proxy_ssl_proc_data(pan_proxy_ssl.c:1040): pan_ssl_proxy_parse_data() failed -1, not block 104.47.28.22[443]-->10.193.82.54[4708]