XG Firewall CAA "Could not validate certificate! CAA will now close" error on Win 10 client

Hello Paul Norris1,

Thank you for reaching out to the community, based on the reported issue as it was working fine previously, it seems XG is sending the CA certificate with the future date stored under “/conf/certificate/internalcas/ClientAuthentication_CA.der” 

Resolution:

1) Need to rollback to previous version where CAA agent is working fine.

2) Make sure that time is correctly set on the appliance in that firmware version.

3) Upgrade the firmware.

Sophos Firewall OS v19 MR1 is Now Available: https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v19-mr1-is-now-available

Hello,

we have the same problem and the time on firewall and client is correct.

The installation with the firmware v19-mr0 runs since the 1st of july 2022 without the certificate error.

When I try to access the firewall with port 9922 then I get a certifcate valid until Tue, 09 Aug 2022 10:10:03 GMT.

The sophos support do not find the certificate on the firewall GUI.

How can I renew this certificate?

Is the only solution to upgrade to v19-MR1?

That is not a good solution.

Thanks & Regards

Bernd Klusemann

Hi Uli Schrupp 

To Regenerate certificate authority follow the below steps 

Verify that all the details are filled in the "Default" certificate authority in System | Certificate | Certificate Authority | Default? Fill up the details and re-download the client for a fresh installation.

The latest firmware is available for upgrade : https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v19-mr1-re_2d00_release-build-365-is-now-available 

Thanks and Regards

We too all of a sudden started having could not validate certificate errors with our CAA. I updated to verison 19.0.0 GA-Build317 back in April and didn't have any issues until today. I verified the time on our AD server, our client PCs, and XG firewall and all was correct. I then regenerated the certificates, uninstalled CAA, re-imported certificate, and re-installed CAA all with no luck. I was about to update to latest firmware when I decided to just reboot the XG firewall. After reboot of XG firewall, CAA started working. Maybe all I had to do was reboot our XG firewall? Just wanted to share and  hopefully save someone out there a little time.

Hi ptinspector 

I would suggest to upgrade the firmware to the latest version and share the feedback 

The latest firmware is available refer the following link : https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v19-mr1-re_2d00_release-build-365-is-now-available 

Regards

Hi ptinspector 

I would suggest to upgrade the firmware to the latest version and share the feedback 

The latest firmware is available refer the following link : https://community.sophos.com/sophos-xg-firewall/b/blog/posts/sophos-firewall-v19-mr1-re_2d00_release-build-365-is-now-available 

Regards