Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 11 replies
  • Subscribers 29 subscribers
  • Views 2138 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Why do I get Certificate Errors on Blocked Categories on XG v18?

MrMojoRisin76

Greetings,

I'm using a self-signed cert for user portal login and admin logins generated by using the devices IP address.  When I log into those sites, the certificate passes through fine.  When end-users hit a site which is in a blocked category, the browser throws a certificate error.  I'm assuming it's using the same self-signed cert to show the blocked page, so why the cert error? Is this because it's an external site being accessed?  The URL  shows as https://x.x.x.x:8090/ips/......



This thread was automatically locked due to age.
Parents
  • 0

    Now on Sophos XG v18 you have two different Certificates Authority; One that is used by default for the new DPI Engine, and another which is the Appliance Certificate. (Which has primarily used for HTTPS Decrypt with the Web Proxy.)

    When a connection gets blocked, the firewall will redirect the client to itself over Port 8090, but in this connection by default It uses the Appliance Certificate which is different from a different CA you imported to your users; << This is why your users get a certificate error.

    There's two ways to fix this, the first one is to generate a new Certificate using the new CA that is used for the DPI Engine - and use this certificate for the Firewall WebUI.

    Another one is to get a certificate which is public signed, you can get It from your domain register (If you pay) or generate one through Let's Encrypt, and then use this certificate for the Firewall WebUI.

    Or at last, you can change the DPI Engine to use the Appliance Certificate Authority, and then re-import the CA to the machines.

    Thanks!



    Just found out It's STILL NOT POSSIBLE.
    [edited by: Prism at 5:00 PM (GMT -7) on 20 Oct 2020]
Reply
  • 0

    Now on Sophos XG v18 you have two different Certificates Authority; One that is used by default for the new DPI Engine, and another which is the Appliance Certificate. (Which has primarily used for HTTPS Decrypt with the Web Proxy.)

    When a connection gets blocked, the firewall will redirect the client to itself over Port 8090, but in this connection by default It uses the Appliance Certificate which is different from a different CA you imported to your users; << This is why your users get a certificate error.

    There's two ways to fix this, the first one is to generate a new Certificate using the new CA that is used for the DPI Engine - and use this certificate for the Firewall WebUI.

    Another one is to get a certificate which is public signed, you can get It from your domain register (If you pay) or generate one through Let's Encrypt, and then use this certificate for the Firewall WebUI.

    Or at last, you can change the DPI Engine to use the Appliance Certificate Authority, and then re-import the CA to the machines.

    Thanks!



    Just found out It's STILL NOT POSSIBLE.
    [edited by: Prism at 5:00 PM (GMT -7) on 20 Oct 2020]
Children