Upgraded XG330 Appliance from 17.5.12 to 17.5.13 - Lost connection to Web console and user portal: "PR_END_OF_FILE_ERROR"

PR_END_OF_FILE_ERROR - Do you use Firefox? 

As Firefox sometimes shows this error, if the website is not reachable because problems with the certificate.

https://support.mozilla.org/nl/questions/1267074#:~:text=This%20means%20that%20Firefox%20wasn,%2Din%2Dthe%2Dmiddle.&text=You%20can%20check%20the%20connection%20settings.

Can you connect to the Webadmin with other browser? 

You can reset the webadmin certificate via CLI (SSH or Console access). https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/cli/nsg/sfos/concepts/cli_WebAdminCertificate.html

Thanks for quick reply.

Other browser same thing: Internet Explorer: Unable to display page.

Edge: No secure connection possible.

But again: There is no certificate shown up in any browser. This at least should work.

You should take a look at the CLI, if XG actually response to the Port 4444 request or not. Use tcpdump for this. 

Solved it and resetted the cert via cosnole (2->4).

Followed this article: https://community.sophos.com/kb/en-us/133678

Thanks for help!

Thank you for the instructions on using the Cosole option of 2. System Configuration and then 4. Reset Default Web Admin Certificate to reset this and show the web interface again.

The command line guide misses this step, it only shows the response once you get here, not the steps on how to arrive at the page. https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/cli/nsg/sfos/concepts/cli_WebAdminCertificate.html?hl=reset%2Cweb%2Cadmin%2Ccli 

Unfortunately when I logged in and reset the web admin certificate back to the one I had deployed previously, it once again failed to load and to get the page back, I needed to reset the certificate again and then reboot the device to get access.

I think there is a problem with self signed certificates in the new vesion.

I cannot use the old one with a 5 year term or a new one with a 1 year term for accessing the web portal.

Update: I ended up reverting to the 17.5.12 firmware on this device to make it available, I attempted to apply the update again and encountered the same error after installation so will be returning this device to the 17.5.12 firmware until this is resolved and won't be deploying 17.5.13 on my other devices.

OK. That's bad.

I think 17.5.13 has gerenal problems.

Also the pop up for the update has no correct buttons in place:

These ghost buttons are on all available XGs.

How can anyone be checking these releases when you install an update and multiple people cant even get to the GUI?

Its probably okay when you have 10 devices but what happens when you have 2000?

Just another in the long line of total f ups by this dev team.

Hi All,

I'm following up with our development teams to help investigate this issue.

TevorHinch and DBASQL - Will be reaching out to you via PM shortly.

TevorHinch said:

Thank you for the instructions on using the Cosole option of 2. System Configuration and then 4. Reset Default Web Admin Certificate to reset this and show the web interface again.

The command line guide misses this step, it only shows the response once you get here, not the steps on how to arrive at the page. https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/cli/nsg/sfos/concepts/cli_WebAdminCertificate.html?hl=reset%2Cweb%2Cadmin%2Ccli 

Unfortunately when I logged in and reset the web admin certificate back to the one I had deployed previously, it once again failed to load and to get the page back, I needed to reset the certificate again and then reboot the device to get access.

I think there is a problem with self signed certificates in the new vesion.

I cannot use the old one with a 5 year term or a new one with a 1 year term for accessing the web portal.

 

Update: I ended up reverting to the 17.5.12 firmware on this device to make it available, I attempted to apply the update again and encountered the same error after installation so will be returning this device to the 17.5.12 firmware until this is resolved and won't be deploying 17.5.13 on my other devices.

 

 

 

Would be nice if they even allowed you download the previous firmware anymore.  When I waited on hold for an hour to talk to a technician, they told me they wouldn't release MR-12 to me....

So for future updates...DON'T use the built in update feature on the XG's.  Log into the Sophos ID / MySophos and download a copy of the firmware for safe keeping.

Did you see the post in the release notes about this issue? 

Hi everyone,

We reached out to some community participants who reported the issue of PR_END_OF_FILE_ERROR. Initial analysis pointed to - certificate validation failed due certificate AddTrust External CA Root for Sectigo root CA expired on May 30th 2020. more details/ access awaited for further analysis.

Please refer:

- Certificate validation issues for the Sectigo root CA https://community.sophos.com/kb/en-us/135536

- community.sophos.com/.../upgraded-xg330-appliance-from-17-5-12-to-17-5-13---lost-connection-to-web-console-and-user-portal-pr_end_of_file_error

- community.sophos.com/.../firmware-update-no-longer-access-webadmin