Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 14 replies
  • Subscribers 31 subscribers
  • Views 2861 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Root Certificate automatically included by WAF of Sophos Firewall?

Markus Quirmbach

Hi everyone!

We are using a Sophos XGS2300 (SFOS 19.0.1 MR-1).

We uploaded a pfx-certificate to the WAF which specifically included only the webserver certificate itself and its intermediate certificate.

But, when we check the site with a tool like https://www.ssllabs.com/ssltest/ we see that the server (e.g. the Sophos Firewall) also sends the root certificate. Which is not what we want and which we don't see when we check sites like microsoft.com.

Are we correct to assume that this is done by the XGS? Is that intentional? Is there a way to circumvent this?

Thanks!

Best regards,

  Markus



This thread was automatically locked due to age.

Top Replies

  • in reply to Markus Quirmbach +2 verified

    Hi Markus,

    Yes, it is intentional. If a certificate is signed by a valid root CA that is part of the CA package available to XG (which should be the case in most scenarios) then WAF will always return the full certificate chain.

    This is the expected behavior, returning a partial chain is flagged by most test tools as a potential security vulnerability, and thus an automatic PCI scan failure.

    At the moment there is no option to influence this behavior.

    I understand the concern about the added latency, however, the impact in real life should be negligible on today's hardware.

    Regards,

    Attila Kovacs

    Jump to answer
Parents Reply Children
No Data