Unable to configure Network Agent on iOS 13.4

Hi Alexandre Lemaire 

This issue is also related to Apple’s new certificate requirement only. (https://support.apple.com/en-in/HT210176)

All TLS server certificates must comply with these new security requirements in iOS 13

As of now, NC-54689 raised with the Development team to take the requirement furthers with the upcoming SF OS release. As of now fix version not marked yet as progress or work ongoing.

Till the time you may use a workaround like Captive portal or IP, MAC-based rule, etc which is suitable based on your infrastructure or setup.

Thank you for the detailed answer.  It's unfortunate that the fix is not yet underway, is there a way to vote for features so that they can garner traction?

Hi Alexandre Lemaire 

The development team is working on the issue with the highest priority and when it is available, we will inform you as well as publish the information on our public forums.

Just following up on the issue! Seems things have changed a bit, I now see "Install client certificate in iOS 13 and later" as a new option.  

If I click this, it asks "Open in "Network Agent"?"

I answer Open, and see a screen with prompt "A new certificate was found.  Do you want to import it?   Yes No"

I click Yes, and see "Download Error" appear.

Hi

I get the exact same "Download Error"

Is there any update or fix for this?

Regards,

Riaan

Ok, it seems I was getting the Download Error because I did not install the Sophos CA certificate within my phone.

After I installed it I could then download the iOS certificate and all worked perfectly.

I've installed the CA cert and still have the same error.  Was there a trick to it?

I've installed the CA cert and still have the same error.  Was there a trick to it?

Hi Alexandre!

I spent some focused time on this case and got it work from now on!

You should refer to this article: https://community.sophos.com/kb/en-us/123755, it helped me a lot.
To summarize this you should follow these steps (tested under iOS 13.6):

• setup a self-signed certificate signed to the XG's ip-address
• download the default-certificate (CA of your XG)
• install the CA-certificate (.pem or .der) on your iOS device
• make sure, you trust these certificates afterwards (settings-about-trusted certificates)
• login to UserPortal on iOS device and download the needed file for the network agent

I hope this will work for you!