This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

vpn stopped working with certificate error

ssl vpn has stopped working with the following error, how to fix?

Sun May 31 09:49:16 2020 VERIFY ERROR: depth=3, error=certificate has expired: C=SE, O=AddTrust AB, OU=AddTrust External TTP Network, CN=AddTrust External CA Root

This thread was automatically locked due to age.

Parents

0 Infra Riksbyggen over 5 years ago

can i remove these?
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Infra Riksbyggen

Which Certificates do you use?
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to LuCar Toni

Hi,

I think this thread has the answer, but not the solution.

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/120757/xg-shows-site-access-error-of-expired-ssl-certificate---when-certificate-is-still-valid/439577#439577

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Infra Riksbyggen over 5 years ago in reply to rfcat_vk

We deleted all the CA certs that went out 30/05 , and then got our users to re-download the new vpn configuration file, this resolved the issue. Sophos support recommended regenerating the appliance configuration cert but we didn't really fancy that option given that the problem was to do with vpn configuration!
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Infra Riksbyggen over 5 years ago in reply to rfcat_vk

We deleted all the CA certs that went out 30/05 , and then got our users to re-download the new vpn configuration file, this resolved the issue. Sophos support recommended regenerating the appliance configuration cert but we didn't really fancy that option given that the problem was to do with vpn configuration!
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Infra Riksbyggen over 5 years ago in reply to Infra Riksbyggen

fwiw, the problem seemed only to affect users who had got a configuration file after we updated to SFOS 17.5.9 MR-9.HF052220.1 , users with config files prior to that were unaffected as it seems the only checked the ca chain down to level 2.
Cancel
Vote Up 0 Vote Down

Cancel
0 FormerMember over 5 years ago in reply to Infra Riksbyggen

Hi Infra Riksbyggen

I would advise you to check this KB Article for more info: SSL VPN remote client users are not able to connect due to 3rd party Root CA Sectigo expired.

Thanks,
Cancel
Vote Up 0 Vote Down

Cancel