Thread Info
  • State Verified Answer
  • +5 person also asked this people also asked this
  • Locked Locked
  • Replies 9 replies
  • Subscribers 35 subscribers
  • Views 13319 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SERVER-WEBAPP Lets Encrypt SSL certificate issuer detected - Some sites not loading

JohnHilton

This became an issue in the 14th of this month. (IPS pattern update?)

We use HTTPS intercept and scanning and of course have IPS enabled on the firewall rule for our users. We have a deployed cert that is current via gpo.

We started to notice that some of the sites the users access are not loading.

 

Looking at the logs and reports i see the following:

 

Is there a config issue here, a false positive or something to be concerned about?

 

Any info would be great.

 

cheers

 



This thread was automatically locked due to age.
Parents
  • 0

    As you can see, the IPS has a Pattern Set which blocks all sites issued by Lets Encrypt.

    I assume, you have this rule enabled in Policy 7, correct? Do you use a 2U Unit (XG550, 650, 750) ? 

    You need to disable (untick) it in this Policy.  

  • 0 in reply to LuCar Toni

    Yes you're totally correct.

    We have a XG430.

    We currently have this set in IPS:

     

    Does the "SERVER-WEBAPP Lets Encrypt SSL certificate issuer detected" policy replace this? as the Allow 'OpenSSL Alternative Chains Certificate Forgery Policy Bypass' sig doesn't seem to exist anymore.

     

    Thanks for your speedy response 

  • +1 in reply to JohnHilton

    Mh, i do not know the answer to this. Maybe ask the Sophos Support for a valid answer. 

    But the Lets Encrypt IPS Pattern is kinda new to the "smaller" appliances. First time saw it on a XG750. Seems like this rule got deployed to the smaller appliances. 

    Just add this Rule to the allow rule. 

  • 0 in reply to LuCar Toni

    I am seeing this too, on an XG105.

    Can you explain "Just add this Rule to the allow rule."

    Add which rule where?

  • +1 in reply to Paul Digby

    The point is, there is no "easy" way to exclude one simple rule out of the predefined rule set. 

    You could switch in the IPS policy rules to "Select individual signature" and select everything except the Lets Encrypt rule. This is not simple and takes couple of minutes. 

    I am currently trying to build up a XML API to do this task. There are couple of changes in the pipeline for XGv17.5 and 18.0 to address this. 

    We are talking about the alerts (so basically the alerts will appear, the session is allowed). 

    Would recommend you guys to open a Case as business customers to give the support a higher visibility for this "reporting issue". 

  • 0 in reply to LuCar Toni

    You're right.

    I did dig deeper and to manually scroll down to 'w' (Web-Server) to get to Let's Encrypt is a mighty pain.

    Let's hope their is improvement with v17.5. If not, we'll have to make a feature request.

  • 0 in reply to LuCar Toni

    LuCar Toni said:

    The point is, there is no "easy" way to exclude one simple rule out of the predefined rule set. 

    You could switch in the IPS policy rules to "Select individual signature" and select everything except the Lets Encrypt rule. This is not simple and takes couple of minutes. 

    I am currently trying to build up a XML API to do this task. There are couple of changes in the pipeline for XGv17.5 and 18.0 to address this. 

    We are talking about the alerts (so basically the alerts will appear, the session is allowed). 

    Would recommend you guys to open a Case as business customers to give the support a higher visibility for this "reporting issue". 

    Please send me a PM with your support case ID for tracking purposes as well please.

Reply
  • 0 in reply to LuCar Toni

    LuCar Toni said:

    The point is, there is no "easy" way to exclude one simple rule out of the predefined rule set. 

    You could switch in the IPS policy rules to "Select individual signature" and select everything except the Lets Encrypt rule. This is not simple and takes couple of minutes. 

    I am currently trying to build up a XML API to do this task. There are couple of changes in the pipeline for XGv17.5 and 18.0 to address this. 

    We are talking about the alerts (so basically the alerts will appear, the session is allowed). 

    Would recommend you guys to open a Case as business customers to give the support a higher visibility for this "reporting issue". 

    Please send me a PM with your support case ID for tracking purposes as well please.

Children
No Data