missing ca certs of public urls in xgs appliance ?

Question

Hi all, 
 we have installed a new xgs firewall and up to now we trying to keep things save and at a high security level. So we also check Certificate Errors. Today we get an error when access a site which i dont understand. Sophos says TLS Cert is invalid. But if i look at the certificate all is ok ? how can i check with xgs admin webif if some https url is ok ? is there some diagnostic tool ? 
 
 below is the entry in log. invalid issuer points me to the right ca is not installed ? i dont want to whitelist any error. better would be to import the missing ca certs ? 
 2021-12-14 09:05:12SSL/TLS inspectionmessageid="19007" log_type="SSL" log_component="SSL" log_subtype="Reject and notify" severity="Information" user="noga@arcus.local" src_ip="xxxxxxx" dst_ip="xxxxxxxx" user_group="xxxxxxxxxxxx" src_country="R1" dst_country="ITA" src_port="53139" dst_port="443" app_name="" app_id="0" category="Travel" category_id="76" con_id="866141120" rule_id="2" profile_id="2" rule_name="xxxxxxxxxxxxx" profile_name="Block insecure SSL" bitmask="Invalid issuer" key_type="KEY_TYPE__RSA" key_param="RSA 2048 bits" fingerprint="1a:67:3e:05:a6:0e:a2:98:69:1f:1a:94:11:8b:e9:fa:05:d2:a6:2c" resumed="0" cert_chain_served="FALSE" cipher_suite="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" sni="server.matteothun.com" tls_version="TLS1.2" reason="Blocked due to invalid TLS certificate" exception="" message=""

LHerzog · Answer

Hi 
 the error is Invalid issuer 
 The XG(S) do not have all those CAs out there on board. 
 You need to get the missing CA Certs and add them to the Cert store of the firewall. First be sure if you trust the CA. I would check if my favourite browser trusts them and then add to FW. 
 https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/118397/sophos-xg-firewall-how-to-add-an-external-certificate-authority-ca 
 
 btw: the new endpoint web module also blocks this page because of incomplete/untrusted CA chain 
 Website blocked

Location: https://server.matteothun.com/

We've blocked access to this URL due to your policy. 
 The encryption used by the server hosting this URL is insecure.

https://www.digicert.com/help/ result

Vishal_R · Answer

Hi Robert Bude : Thank you for contacting Sophos community team. For missing CA cert details you may try the below steps from the XG shell. #openssl s_client -connect <website for which above error coming>:443 Example: #openssl s_client -connect www.idfcfirstbank.com:443 With the above command, you may be able to verify the cert verification is getting failed due to any missing CA, and based on that you may download that CA file from the cert provider website and may add it on XG under System ==> Certificate ==> Certificate Authorities ==> Click on Add. After adding CA you may verify the OpenSSL status again and if it gives the Ok result (Verify return code: 0 (ok)) then the site will work fine without any issue. Generally, such an issue may get triggered due to the option &ldquo;Block Invalid Certificates&rdquo; under Web ==> General is set to ON and if any website has a missing cert chain on XG (just because of the intermediate root CA from which the website end cert has been signed).

missing ca certs of public urls in xgs appliance ?

Top Replies