Web filtering CA issues

Hi,

Just to be clear: https://community.sophos.com/kb/en-us/132997

You want to use a CA for HTTPs Scanning? 

I don't have Https scanning enabled this is so I don't get an error when sites are blocked by the URL. Yes I want to use a CA

Can you explain in which scenario you use your https certificate? 

I've got an Active Directory CA which has issued a CA which is installed on XG. I am trying to use this to prevent the error which would normally be displayed if a site with HTTPS is blocked

First of all, you need for this HTTPs Scanning. Then you need a this CA to be used as the block page certificate.

https://community.sophos.com/kb/en-us/132058

You need to setup the Hostname for be used for the blockpage. This CA should be imported as Certificate to be used properly for the block page.

That doesn't appear to affect the blocked page. Blocked sites are being generated a new certificate by XG just not using the CA which I've installed. This used to work fine however after rebuilding using 17.1.3 this functionality seems to be broken

LuCar - the CA is used any time that we do man-in-the-middle, which includes HTTPS Decrypt and Scan off and displaying a block page.

Kieran - You can use an intermediate CA, however the XG need to have the chain up to the root.  Have you also installed the root CA for it (you don't need the private key because you wont be creating certificate from it).

https://community.sophos.com/kb/en-us/132997

LuCar - the CA is used any time that we do man-in-the-middle, which includes HTTPS Decrypt and Scan off and displaying a block page.

Kieran - You can use an intermediate CA, however the XG need to have the chain up to the root.  Have you also installed the root CA for it (you don't need the private key because you wont be creating certificate from it).

https://community.sophos.com/kb/en-us/132997