This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Certificate could not be verified only while https is scanning

When scanning https for any local IP I am receiving a stop/block: The URL/Site has a valid SSL Cert and I can access the site without https scanning active. The firewall Rules are allowing. Unable to determine why the STOP is occurring when scanning https. I have been running https scanning without issue until this event.

Running : SFVH (SFOS 17.5.7 MR-7)

Message:

Stop!
This website is a security risk
Access to this website has been blocked because the website cannot prove its identity.
Return to previous page

Reason for blocking this site
The issuer of this website's certificate could not be verified. This could mean that the website is not configured correctly.

About this request
URL: https://mypti.com/
Certificate details:
Valid From: Oct 1 14:23:51 2018 GMT
Valid To: Nov 21 20:29:01 2020 GMT
Serial Number: 45:14:a3:e4:5d:4d:16:8a
Subject: jurisdictionC=US, jurisdictionST=Florida, businessCategory=Private Organization, serialNumber=P08000006680, C=US, ST=Florida, L=Deerfield Beach, O=People's Trust Insurance Company, CN=mypti.com
Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com
Inc./OU=certs.godaddy.com/.../CN=Go Daddy Secure Certificate Authority - G2

SSL error: unable to get local issuer certificate

This thread was automatically locked due to age.

Parents

0 kieran stoney over 6 years ago

Are these sites certificates issued by a local CA or a public CA? If a local CA is the certificate of the CA installed on XG as a trusted CA
Cancel
Vote Up 0 Vote Down

Cancel
0 Rick Dunn over 6 years ago in reply to kieran stoney

I am not sure what you are asking. The site's SSL cert details is posted and is thru GoDaddy, public... I have a policy to scan https using the local XG FW and its local cert loaded on the local clients. Does this help?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 6 years ago in reply to Rick Dunn

You access a internal resource.

This Ressource has a HTTPs Certificate.

Can XG verify this Certificate? Is it matching to the hostname etc?

XG access this Page like Client would do and check, if this Certificate is "legit".
Cancel
Vote Up 0 Vote Down

Cancel
0 Rick Dunn over 6 years ago in reply to LuCar Toni

The site's certificate is valid ... both Chrome and Firefox show it as such. https://mypti.com Only XG FW is unable to make this determination when https scanning is activated. Is there a log file I can look in to find more details of the failure? I would like to get this resolved.

Thanks
Cancel
Vote Up 0 Vote Down

Cancel
0 Rick Dunn over 6 years ago in reply to Rick Dunn

SOPHOS support ticket #9065237 request showed the Web site's CA chain for the SSL cert was improperly built so the top level CA certs from GoDaddy were not linked to allow XGFW to properly validate the SSL cert as most web browsers can. I uploaded the particular chained CA Cert from GoDaddy into my XGFW CA and the https scanning works without error.

In case anyone else runs across an error similar....
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Rick Dunn over 6 years ago in reply to Rick Dunn

SOPHOS support ticket #9065237 request showed the Web site's CA chain for the SSL cert was improperly built so the top level CA certs from GoDaddy were not linked to allow XGFW to properly validate the SSL cert as most web browsers can. I uploaded the particular chained CA Cert from GoDaddy into my XGFW CA and the https scanning works without error.

In case anyone else runs across an error similar....
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Rick Dunn over 6 years ago in reply to Rick Dunn

As a Workaround, in case the site owner doesn't correct this issue, you can import the CA certificates into Sophos following this article.
https://community.sophos.com/kb/en-us/123036
Cancel
Vote Up 0 Vote Down

Cancel