This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web filter causes "Revocation" errors.

I have advertisements blocked on my web filter settings.

Several websites a user goes to, I get certificate errors pointing to a ssl cert issued by: "Sophos SSL CA_*" and I'm not doing SSL filtering. Just regular HTTP filtering.

Any idea how to fix this so I can actually use the web filter?

This thread was automatically locked due to age.

Parents

0 rfcat_vk over 6 years ago

Hi,

Please post an expanded screenshot of the offending rule.

Thank you

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Greg Rogers over 6 years ago in reply to rfcat_vk

Here you go.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Greg Rogers

Hi Greg,

that is a policy not a firewall rule. In your policy you appear to have advertisements https blocked.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Greg Rogers over 6 years ago in reply to rfcat_vk

Where in that previous photo did it say anything about https? This is the firewall rule, the top portion of this page is just a default Source: LAN/Any/Allthetime, Dest: WAN/Any/Any.
Cancel
Vote Up 0 Vote Down

Cancel
0 Greg Rogers over 6 years ago in reply to rfcat_vk

Ah there is a VERY hidden icon beside the red shield white x icon, for controlling to block/allow/warn https. I guess I can hit allow for that since I'm not going to be doing ssl filtering....since that requires installing a ssl cert on every single pc.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Greg Rogers

Hi Greg,

sounds like a plan to me.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Greg Rogers over 6 years ago in reply to rfcat_vk

I have bit defender installed on these systems. I've went ahead and installed the SSL via gpo on all the systems, and tested it. It causes the Bit Defender web filter to now do a certificate revocation listing the bit defender SSL as an issue. Sigh. Whereas if I remove the web filter, I never get any bit defender revocations. Wish I knew a way to get those two to play together.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Greg Rogers

Hi Greg,

is bit defender managed from a central site or is each installation unique?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Greg Rogers over 6 years ago in reply to rfcat_vk

managed via solarwinds n-able so centrally.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Greg Rogers

So, in theory you could add the Sophos CA to the bit defender remotely.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Greg Rogers over 6 years ago in reply to rfcat_vk

Unfortunately no, we don't have control over the CA BD uses.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 6 years ago in reply to Greg Rogers

Hi Greg,

so what you are saying is that BD is doing MiM searches and is competing with the XG MiM search. You could try importing the BD CA into the XG and use that instead.

Ian
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 rfcat_vk over 6 years ago in reply to Greg Rogers

Hi Greg,

so what you are saying is that BD is doing MiM searches and is competing with the XG MiM search. You could try importing the BD CA into the XG and use that instead.

Ian
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Michael Dunn over 6 years ago in reply to rfcat_vk

Two solutions:

The better way:

Download the Bitdefender CA. Upload it to Certificates / Certificate Authorities. You are not using it as a scanning CA (you don't need private key), you just adding it as a CA that you trust.

The big hammer way:

Web / General Settings / Block invalid certificates. Turn this off. Note that this affect all invalid everywhere.
Cancel
Vote Up 0 Vote Down

Cancel