Web Policy Alert no working at all (certificate error)

Hi,

You are using the WARN Page. This page has a link on the bottom which leads to the XG. This is ether an IP or a hostname (depends on the console settings: https://community.sophos.com/kb/en-us/132058 ).

The XG will use the same certificate like for the user portal / webadmin. So this most be trusted for  the clients.

So you can go with two options. Use a self signed certificate and deploy it to the clients or use a public signed certificate for this.

https://community.sophos.com/kb/en-us/126526

Thansk buddie, do you know where can i get a valid certificate? thanks

For free: letsencrypt 

cost: Check out the CAs for prices. 

Just google pages for valid Certificates. 

thanks again buddie, i see on the letsencrypt.org page that the certificate is for webhosting, actually we have on our website a certificate with godaddy, can i use that again on the sophos firewall? thanks

It depends. 

Most of the time, you use the hostname of XG as a own certificate. XG.domain.com for example. This is possible with wildcard or an own certificate. 

i think is better to do a new one right, thanks

Hi again hehe, im in throuble to make it work hehe, do you know a wizard online to generate a certificate (i see sophos ask for a pem and key file) for a local domain like mydomain (i understand this could be the name of the device, in this case my xg sophos firewall) instead of creating a certificate for an IP

thanks

There are two different issues:

If you are getting a warn page on an HTTPS site (eg https://pokerstars.com/), then the XG needs to do HTTPS decryption of the page.  The XG has a Certificate Authority which creates a certificate on-the-fly for pokerstars.com so that it can display the warn page.  Your browser will get a certificate warning, unless you have installed the XG's CA into the browser.

Secondly, the warn page has a Proceed link on it.  To remove the warning you need to purchase a certificate from a known authority.  They will provide you with the PEM (etc) files.  See here for how to install and configure.

https://community.sophos.com/kb/en-us/132058

There are two different issues:

If you are getting a warn page on an HTTPS site (eg https://pokerstars.com/), then the XG needs to do HTTPS decryption of the page.  The XG has a Certificate Authority which creates a certificate on-the-fly for pokerstars.com so that it can display the warn page.  Your browser will get a certificate warning, unless you have installed the XG's CA into the browser.

Secondly, the warn page has a Proceed link on it.  To remove the warning you need to purchase a certificate from a known authority.  They will provide you with the PEM (etc) files.  See here for how to install and configure.

https://community.sophos.com/kb/en-us/132058