Where is V18 at?

I have switched of ssl inspection, because I have too many mobile and IOT devices to update with a trusted can to make this work. Http is hardly used any more, so http only scanning is not useful.

So I would like a solution for this in an upcoming Sophos release.

As a workaround I have started to use bitdefender on Windows boxes and have that do the SSL scanning. It inserts a trusted certificate and avoids the issues I had on Windows boxes with SSL scanning with Sophos.

I have switched of ssl inspection, because I have too many mobile and IOT devices to update with a trusted can to make this work. Http is hardly used any more, so http only scanning is not useful.

So I would like a solution for this in an upcoming Sophos release.

As a workaround I have started to use bitdefender on Windows boxes and have that do the SSL scanning. It inserts a trusted certificate and avoids the issues I had on Windows boxes with SSL scanning with Sophos.

What exactly would you like to see in the upcoming SFOS? Deploying certificates to domain machines can be done via a group policy. BYOD is a huge problem for us. Getting the certificate installed on over 1000 devices is an administrative nightmare.

Do you not manage the BYOD devices with any form of MDM/EDM?

envercpt said:

What exactly would you like to see in the upcoming SFOS? Deploying certificates to domain machines can be done via a group policy. BYOD is a huge problem for us. Getting the certificate installed on over 1000 devices is an administrative nightmare.

 

Some useful information and an explanation in this thread.

HTTPS bypasses Suspicious web filter

I too have had some BYOD devices - and not helped with a client who expects devices to just work and cannot understand why users need or should have to install anything on their devices to get it to work - they just want it to be trouble free, connect and away they go...

We did deploy certificates to domain machines, but that was not sufficient. Some machines use Java and then it required additional steps. Visual Studio requires additional steps and kept breaking it with updates.

So maybe a small Windows client that handles the certificate would be good. It can point to a well known CA.

We don't need SSL scanning for iot devices and mobile, just for Windows.

Hi,

please start a new thread on this subject it is way off the aim of this thread.

Thank you

Ian

Deploying CA via GPO and then you can exclude the few sites that can't deal with a MITM for trusted apps, a custom Endpoint client would be good however to give both heartbeat and cert so you are ensuring the endpoint is at least clean