Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 2 replies
  • Answers 2 answers
  • Subscribers 28 subscribers
  • Views 1170 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

missing ca certs of public urls in xgs appliance ?

Robert Bude

Hi all,

we have installed a new xgs firewall and up to now we trying to keep things save and at a high security level. So we also check Certificate Errors. Today we get an error when access a site which i dont understand. Sophos says TLS Cert is invalid. But if i look at the certificate all is ok ? how can i check with xgs admin webif if some https url is ok ? is there some diagnostic tool ?

below is the entry in log. invalid issuer points me to the right ca is not installed ? i dont want to whitelist any error. better would be to import the missing ca certs ?

2021-12-14 09:05:12SSL/TLS inspectionmessageid="19007" log_type="SSL" log_component="SSL" log_subtype="Reject and notify" severity="Information" user="noga@arcus.local" src_ip="xxxxxxx" dst_ip="xxxxxxxx" user_group="xxxxxxxxxxxx" src_country="R1" dst_country="ITA" src_port="53139" dst_port="443" app_name="" app_id="0" category="Travel" category_id="76" con_id="866141120" rule_id="2" profile_id="2" rule_name="xxxxxxxxxxxxx" profile_name="Block insecure SSL" bitmask="Invalid issuer" key_type="KEY_TYPE__RSA" key_param="RSA 2048 bits" fingerprint="1a:67:3e:05:a6:0e:a2:98:69:1f:1a:94:11:8b:e9:fa:05:d2:a6:2c" resumed="0" cert_chain_served="FALSE" cipher_suite="TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" sni="server.matteothun.com" tls_version="TLS1.2" reason="Blocked due to invalid TLS certificate" exception="" message=""



This thread was automatically locked due to age.
Parents
  • 0

    Hi : Thank you for contacting Sophos community team. For missing CA cert details you may try the below steps from the XG shell.

    #openssl s_client -connect <website for which above error coming>:443

    Example:
    #openssl s_client -connect www.idfcfirstbank.com:443

    With the above command, you may be able to verify the cert verification is getting failed due to any missing CA, and based on that you may download that CA file from the cert provider website and may add it on XG under System ==> Certificate ==> Certificate Authorities ==> Click on Add.

    After adding CA you may verify the OpenSSL status again and if it gives the Ok result (Verify return code: 0 (ok)) then the site will work fine without any issue.

    Generally, such an issue may get triggered due to the option “Block Invalid Certificates” under Web ==> General is set to ON and if any website has a missing cert chain on XG (just because of the intermediate root CA from which the website end cert has been signed).

Reply
  • 0

    Hi : Thank you for contacting Sophos community team. For missing CA cert details you may try the below steps from the XG shell.

    #openssl s_client -connect <website for which above error coming>:443

    Example:
    #openssl s_client -connect www.idfcfirstbank.com:443

    With the above command, you may be able to verify the cert verification is getting failed due to any missing CA, and based on that you may download that CA file from the cert provider website and may add it on XG under System ==> Certificate ==> Certificate Authorities ==> Click on Add.

    After adding CA you may verify the OpenSSL status again and if it gives the Ok result (Verify return code: 0 (ok)) then the site will work fine without any issue.

    Generally, such an issue may get triggered due to the option “Block Invalid Certificates” under Web ==> General is set to ON and if any website has a missing cert chain on XG (just because of the intermediate root CA from which the website end cert has been signed).

Children
No Data