SSL Certificate Distribution

Hi Matthew,

Are you pertaining to the following?

Installing Sophos Certificate on local computer

https://soph.so/gNxf3q

https://soph.so/EvEfZY

HI Erick,

Nope, its about distributing CA certificates via  a link to clients.

For example in cases where non domain joined   clients need to install CA certificate to enable SSL decryption on firewall. and currently we are deploying Sophos certificate manually on each non -domain joined devices

In smoothwall there is an option to download the certificate which makes its easier to deploy on BYOD users. 

thanks 

Mathew

Hey Manu_Mathew , 

For the domain joined users you can push the cert via AD and for the BYOD users - BYOD devices that are not corporately managed then it is hard to put a Certificate Authority on the device. That being said, they are less likely to have antivirus software on them and therefore are more likely to download or already contain malware. Regardless of the HTTPS Decrypt and Scan, you should probably not have them on the same network segment as the rest of your corporate network or give them access to your corporate network. It is better to put them on a separate guest network.

> SSL CA certificate installation guide: https://support.sophos.com/support/s/article/KB-000035645?language=en_US
------------------
> HTTPS Decrypt and Scan FAQ: https://community.sophos.com/sophos-xg-firewall/f/recommended-reads/121482/https-decrypt-and-scan-faq

Hello Mathew,

Thank you for contacting the Sophos Community.

This would be a feature request, please reach out to your Account Manager/Sales Engineer so they can submit your idea in our internal system, and alternatively you can also submit your feedback using the feedback option within the Firewall (Top of the screen)

Regards,

This seems to be a feature request for us as few other products offer this. 

Yes, its always better to segment networks for security. 

Will do that. Thanks Emmanuel, Do you know is there any feature request already for this, so i can vote on it. 

Hello there,

You can't vote directly, this would be through your Account Manager/Sales Engineer.

Regards,