This article goes over an SSL handshake issue for SSL Proxy that may be seen on vSRX running Junos Release 21.1R1. Users may observe errors such as "domain-name sent an invalid response" or "ERR_SSL_PROTOCOL_ERROR" while accessing secure sites.
Connections inspected by SSL Proxy, when they come from Chrome, will fail at SSL handshake, whereas other browsers will work. The specific error that Chrome gives is:
This site can’t provide a secure connection domain-name sent an invalid response. ERR_SSL_PROTOCOL_ERROR
This site can’t provide a secure connection
domain-name sent an invalid response.
ERR_SSL_PROTOCOL_ERROR
At a deeper level, the symptom is that the SRX device is sending a Signature Algorithm in the Server Key Exchange message, which Chrome did not send as a "Supported Algorithm". This could result in the "ERR_SSL_PROTOCOL_ERROR" or the message that "an invalid response" was sent being displayed in Chrome.
For example, see the following Client Hello that is seen on Chrome's supported algorithms:
Yet the Server Key Exchange message contains an algorithm that is not in that list:
Therefore the client responds with an "Illegal Parameter" Alert message.
Connection then is teared down.
The ERR_SSL_PROTOCOL_ERROR or the invalid response error has so far been confirmed to be fixed by upgrading to Junos Release 21.4R1 or later (21.4R2 and 21.R3).
While not confirmed, explicitly configuring a cipher in the SSL Proxy config may also stop the unexpected behavior (set services ssl proxy profile profile-name custom-ciphers).
set services ssl proxy profile profile-name custom-ciphers