This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG v18 does not use the Common Name of the website certificate.

For example
openssl s_client -connect www.sophos.com:443 -servername www.sophos.com
In this case, No decryption. It is normal.

openssl s_client -connect www.sophos.com:443
In this case, decryption.
I think it's because there is no SNI (Server Name Indication).

The Common Name of the certificate is www.sophos.ccom. "sophos.com" is included in the "Managed TLS exclusion list".
In this case, there should be No decryption. Is this wrong?

If the client does not send the SNI, I want XG to use the Common Name.

Is KB-000035867 invalid?
support.sophos.com/.../KB-000035867

I also want XG to output the Common Name in the log.

This thread was automatically locked due to age.

Parents

0 LuCar Toni over 4 years ago

It depends on the Request.

Web Exceptions (Web -> Exceptions) work based on the SNI.

If you request the Website based on the Domain Name, only DPI Exception based on Destination Host can work.
Cancel
Vote Up 0 Vote Down

Cancel
0 core_memory over 4 years ago in reply to LuCar Toni

Thank you for your reply.

Is the content written in KB-000035867 the case of Web Exceptions?
It says "Version: 16.01.0 onwards".
KB-000035867 is use the Common Name, right?

Adding the site to Web Exceptions did not change the result.
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 4 years ago in reply to core_memory

Web Exceptions will use the SNI, if present. This will take a higher priority. If the SNI is not present, it should fallback to the CN.
Cancel
Vote Up 0 Vote Down

Cancel
0 core_memory over 4 years ago in reply to LuCar Toni

If it works like that, it's okay, but it seems to be different.

Is that behavior using SNI and CN the same for Exceptions in SSL/TLS inspection rules?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 core_memory over 4 years ago in reply to LuCar Toni

If it works like that, it's okay, but it seems to be different.

Is that behavior using SNI and CN the same for Exceptions in SSL/TLS inspection rules?
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data