ZTNA sessions timeout when accessing AWS-routed or on-premise services

Products

• Symantec ZTNA

Issue/Introduction

Users accessing internal applications using ZTNA via WSS Agents.

Users report intermittent connection timeouts when attempting to access services routed through AWS or specific on-premise services.

Timeouts typically occur after 30 seconds on the first connection attempt.

Success is often achieved after one or two manual retries or by opening new tabs.

PCAPs from the ZTNA connector shows SSL handshake fails whenever the problem is reproduced.

Environment

ZTNA segment applications.

WSS Agent.

Cause

Chrome attempting to pull the CRL for the GEN1 certificates that are being presented by Artifactory, TFE, DevPortal etc.

Resolution

Identify the CRL endpoints referenced by the Application certificates and add ZTNA routes for these domains/IP addresses.

In this environment, ZTNA admin created segment applications for the following CRL hosts referenced by the server certificates:

crl.example.com
globalcrl.example.com

Additional Information

As part of the troubleshooting process, it was identified that only Chrome users reported the issue; Edge users worked all the time.

Chrome attempts to pull the Certificate Revocation List (CRL), hitting a 30-second timeout before failing open and proceeding. Edge bypasses this delay due to different default timeout/validation behavior.

As part of the troubleshooting, we modified the /etc/hosts file to set the CRL domain to 127.0.0.1 - this caused the sessions to timeout immediately and the problem went away.