Conflicting results on web service test requiring TLS 1.2

Gallus

We have a need to connect to a service that requires TLS1.2 on the connection.
When I run the test client on our DC it will connect with no issues.
When I run it on a Windows 10 machine I get the error "The underlying connection was closed: An unexpected error occurred on a send".

I can see the following differences in the traffic logs.
192.168.15.49 is the Win 10 workstation traffic.
192.168.15.8 is the Server 2019 traffic.

Both going out the same WAN network - Corp
Both using Outbound HTTPS proxy policy
SourcePublicIP.Redacted shows as our Static WAN. Details pulled for security reasons.
Redacted.gov is a site the TLS Test client is looking at for a certificate.
The only places I see a difference is the tls_version="SSL_0" showing on the workstation traffic. The server side showing tls_version="TLS_V12"
And the App Names, workstation showing SSL/TLS but Server showing HTTP Protocol over TLS SSL

So my understanding here is that when running the client on the server, it sends on TLS1.2 (a changeable option in the client to 1.1 or 1.0, must be 1.2 though) and the site responds with the certificate.
When running the exact same client on the workstation it is somehow switched to SSL and the response fails.

I have verified that the source devices are TLS1.2 only. All lower versions and SSL are disabled.
The server traffic can see the Domain Match from the HTTPS policy exception; ProxyAllow: HTTPS domain name match
The workstation traffic does not see that the site is listed in exceptions.
I have tested multiple different TLS Profiles but it all comes back to this. So now I am here looking for smarter folk than me that will hopefully have an answer.

2025-01-15 22:51:27 FW1 Allow 192.168.15.49 DestinationIP.Redacted https/tcp 54818 443 Corp External Application identified 40 64 (Outbound HTTPS-proxy-00) proc_id="firewall" rc="100" msg_id="3000-0149" src_ip_nat="SourcePublicIP.Redacted" tcp_info="offset 5 AF 3035482593 win 24065" app_id="697" app_name="SSL/TLS" app_cat_id="19" app_cat_name="Network protocols" app_beh_id="6" app_beh_name="Access" action="Global" sig_vers="18.350" src_user="SSOuser@Redacted.local" geo_dst="USA" Traffic

2025-01-15 22:51:27 FW1 Allow 192.168.15.49 DestinationIP.Redacted https/tcp 54818 443 Corp External HTTPS Request (Outbound HTTPS-proxy-00) HTTPS-Client.Standard.Main proc_id="https-proxy" rc="548" msg_id="2CFF-0000" proxy_act="HTTPS-Client.Standard.Main" tls_profile="TLS-Client-HTTPS.Standard.1" tls_version="SSL_0" sni="redacted.gov" cn="" cert_issuer="" cert_subject="" action="allow" app_id="697" app_cat_id="19" app_name="SSL/TLS" app_cat_name="Network protocols" sig_vers="18.350" sent_bytes="163" rcvd_bytes="7" src_user="SSOuser@Redacted.local" geo_dst="USA" Traffic

2025-01-15 22:51:27 FW1 Allow 192.168.15.49 DestinationIP.Redacted https/tcp 54819 443 Corp External HTTPS Request (Outbound HTTPS-proxy-00) HTTPS-Client.Standard.Main proc_id="https-proxy" rc="548" msg_id="2CFF-0000" proxy_act="HTTPS-Client.Standard.Main" tls_profile="TLS-Client-HTTPS.Standard.1" tls_version="SSL_0" sni="redacted.gov" cn="" cert_issuer="" cert_subject="" action="allow" app_id="697" app_cat_id="19" app_name="SSL/TLS" app_cat_name="Network protocols" sig_vers="18.350" sent_bytes="163" rcvd_bytes="7" src_user="SSOuser@Redacted.local" geo_dst="USA" Traffic

2025-01-15 22:51:28 FW1 Allow 192.168.15.49 DestinationIP.Redacted https/tcp 54819 443 Corp External Application identified 40 64 (Outbound HTTPS-proxy-00) proc_id="firewall" rc="100" msg_id="3000-0149" src_ip_nat="SourcePublicIP.Redacted" tcp_info="offset 5 AF 1493665836 win 24065" app_id="697" app_name="SSL/TLS" app_cat_id="19" app_cat_name="Network protocols" app_beh_id="6" app_beh_name="Access" action="Global" sig_vers="18.350" src_user="SSOuser@Redacted.local" geo_dst="USA" Traffic

2025-01-15 22:51:26 FW1 Allow 192.168.15.8 DestinationIP.Redacted https/tcp 65205 443 Corp External ProxyAllow: HTTPS domain name match (Outbound HTTPS-proxy-00) HTTPS-Client.Standard.Main proc_id="https-proxy" rc="590" msg_id="2CFF-0003" proxy_act="HTTPS-Client.Standard.Main" rule_name="Report" sni="redacted.gov" cn="" ipaddress="" src_user="SSOuser@Redacted.local" geo_dst="USA" Traffic

2025-01-15 22:51:27 FW1 Allow 192.168.15.8 DestinationIP.Redacted https/tcp 65205 443 Corp External Application identified 572 128 (Outbound HTTPS-proxy-00) proc_id="firewall" rc="100" msg_id="3000-0149" src_ip_nat="SourcePublicIP.Redacted" tcp_info="offset 5 A 866324252 win 4896" app_id="350" app_name="HTTP Protocol over TLS SSL" app_cat_id="19" app_cat_name="Network protocols" app_beh_id="6" app_beh_name="Access" action="Global" sig_vers="18.350" src_user="SSOuser@Redacted.local" geo_dst="USA" Traffic

2025-01-15 22:51:27 FW1 Allow 192.168.15.8 DestinationIP.Redacted https/tcp 65205 443 Corp External HTTPS Request (Outbound HTTPS-proxy-00) HTTPS-Client.Standard.Main proc_id="https-proxy" rc="548" msg_id="2CFF-0000" proxy_act="HTTPS-Client.Standard.Main" tls_profile="TLS-Client-HTTPS.Standard.1" tls_version="TLS_V12" sni="redacted.gov" cn="redacted.gov" cert_issuer="CN=DigiCert EV RSA CA G2,O=DigiCert Inc,C=US" cert_subject="CN=redacted.gov,O=Federal Deposit Insurance Corporation,L=Arlington,ST=Virginia,C=US,serialNumber=Government Entity,businessCategory=Government Entity,jurisdictionC=US" action="allow" app_id="350" app_cat_id="19" app_name="HTTP Protocol over TLS SSL" app_cat_name="Network protocols" sig_vers="18.350" sent_bytes="1186" rcvd_bytes="6317" src_user="SSOuser@Redacted.local" geo_dst="USA" Traffic

james.carson

TLS 0 means the firewall doesn't recognize or can't open the connection for some reason. That might be due to content inspection not being flagged, or it could mean that the TLS version is weird.

The easiest way I can suggest if the firewall is causing the issue would be to try with a packet filer. If the same issue occurs there, it likely isn't the proxy causing the issue.

If you need more information, I'd suggest opening a support case