XG Firewall CAA "Could not validate certificate! CAA will now close" error on Win 10 client

Question

I went away over the weekend and on login on Monday I now get the following error and the CAA exits, nothing should have changed from when it was last working on Friday. Error: 
 "Could not validate certificate! CAA will now close error" 
 XG Firewall Version: SFOS 19.0.0 GA-Build317 
 Client: Window 10 running Client Authentication Agent v2.0.1 
 What I've tried: 
 
 Regenerated the certificates on firewall, the Default and the appliance ones, 
 Uninstalled the client and reinstalled with fresh download from the user client portal (both MSI and manual cert install version and the .exe). 
 
 Nothing seems to be fixing it. It was working fine before. 
 
 Any ideas?

Vivek Jagad · Accepted Answer

Hello Paul Norris1 , Thank you for reaching out to the community, based on the reported issue as it was working fine previously, it seems XG is sending the CA certificate with the future date stored under &ldquo;/conf/certificate/internalcas/ClientAuthentication_CA.der&rdquo; 
 Resolution: 
 1) Need to rollback to previous version where CAA agent is working fine. 
 2) Make sure that time is correctly set on the appliance in that firmware version. 
 3) Upgrade the firmware. 
 Sophos Firewall OS v19 MR1 is Now Available: https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v19-mr1-is-now-available

Paul Norris1 · Answer

Yes, BIOS time was off by an hour due to clock changes, corrected and it's now working again. I'll update to MR1 once it's released to update channel on device. Thanks.

XG Firewall CAA "Could not validate certificate! CAA will now close" error on Win 10 client

Top Replies