I am getting an invalid certificate error

Hi and welcome,

you need to import the certificate into all machines on your network.

Ian

That is impossible

Okay,

I will rephrase that statement, you need to import the certificate into all machines that browse the web and use mail clients if you have mail scanning enabled otherwise you will get the error.

Ian

Okay,

I will rephrase that statement, you need to import the certificate into all machines that browse the web and use mail clients if you have mail scanning enabled otherwise you will get the error.

Ian

The problem is there s only one certificate and that is the default certificate which is not downloadable. My installation does not have a certificate named SecurityAppliance_SSL_CA. This perhaps the problem.

I am also trying to get a certificate from an organization called CAcert.org. The problem I am running into there is that I do not have a registered domain name. One thing I have not tried is to use the LAN IP address for the common name. I will try that this evening.

Should be answered in the other thread.

https://community.sophos.com/products/xg-firewall/f/initial-setup/104589/ca-setup

There is no SSL certificate in my installation. Please see below:

You need to go to Certificate Authority on top beside of certificates. 

I suspect this going to be an issue with my MBP but I cannot get safari to work with the firewall even after importing the CA. Strange thing is ff now works.

Yes, I have read the KBA a number of times. 

Fails to establish a secure connection.

Any ideas besides rebuild the MBP?

Ian

I suspect I will have to delete all the entries in the keychains regarding the firewall address, regenerate the certificate and then re-install it.

Hi folks,

a good start to the day. I deleted all reference to the XG from the MBP keychain, quit Safari, cleared Safari history. Restarted Safari went through the insecure site connection process, logged into the XG, downloaded the pen certificate and changed all to trust and now Safari appears to be happy.

A possible update to the KBA might be to advise clearing keychains for those failing authentication?

Ian