Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 27 subscribers
  • Views 1176 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

iOS and HTTPS scanning with apps that use certificate pinning issue.

J F

Hello, 

I'm not sure where to put this but here goes. 

I have set up HTTPS scanning on my network and pushed both the SSL certificate and the CA certificate to the iOS devices. I installed the profile and made sure the the certificates are trusted under root. 

The problem that I have found is that some apps use a certificate pinned in the app itself and don't trust the apple certificates on the device. The problem that then happens is that when the firewall decrypts the traffic and re-encrypts it, the certificate is now a Sophos certificate and the app will not communicate because the certificate does not match that one inside the app and it thinks that a man in the middle attack is happening. 

Some of the apps that I found that are not compatible are; Ring doorbell, Honeywell Home Connect, Genisys Credit Union, Flagstar Bank, and I am sure there are many others. 

What can be done about this? I have a feeling that nothing can be done other then not using HTTPS scanning and to me that leaves a major security hole in your network. 



This thread was automatically locked due to age.
Parents
  • 0

    Hi,

    don't forget to check your mail scanning. I have put a lot of exceptions in place for devices that I don't think can be "compromised" or created firewall rules that only allow the device to talk to specific sites. Yes, it becomes a bit messy to maintain, but does improve my feeling of security. I have an IoT devices that has a fixed NTP address using UDP 123 that the XG thinks is a tunnel. 

    Working on building my own internal NTP server then add a rule to direct all devices use that feature.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

Reply
  • 0

    Hi,

    don't forget to check your mail scanning. I have put a lot of exceptions in place for devices that I don't think can be "compromised" or created firewall rules that only allow the device to talk to specific sites. Yes, it becomes a bit messy to maintain, but does improve my feeling of security. I have an IoT devices that has a fixed NTP address using UDP 123 that the XG thinks is a tunnel. 

    Working on building my own internal NTP server then add a rule to direct all devices use that feature.

    Ian

    XG115W - v19.5.1 mr-1 - Home

    If a post solves your question please use the 'Verify Answer' button.

Children
No Data
Cookie Information Banner