This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

signature of the certificate cannot be verified

hello

case #05914000 created

I added the ssl certificate of my vps to the CA and certificate of my sophos XG but now i am getting certificate warnings in outlook even if i install the certificate in trusted roots

the certificate date is valid and the xg has internet .. what am i missing ?

the issued to is the correct pop and smtp server of my vps - i dont have this error when i do not pass thru sophos

thank you

This thread was automatically locked due to age.

Top Replies

Vishal_R over 2 years ago in reply to TarekHalloun +1

Hi TarekHalloun Thank you for reaching out to the Sophos community team. One of the possible reasons for such an error could be due to the signature algorithm having been updated of that CA and the system…

0 TarekHalloun over 2 years ago

Any idea ?
Cancel
Vote Up 0 Vote Down

Cancel
0 TarekHalloun over 2 years ago

still no solution , very slow service
Cancel
Vote Up 0 Vote Down

Cancel
0 Vishal_R over 2 years ago in reply to TarekHalloun

Hi TarekHalloun Thank you for reaching out to the Sophos community team. One of the possible reasons for such an error could be due to the signature algorithm having been updated of that CA and the system may have a different CA with a different thumbprint (due to signature Algo updated) which is not getting matched with the added CA on XG.

Please confirm and validate on same. Below reference steps may help to validate the same on the system side:

http://terenceluk.blogspot.com/2018/07/unable-to-assign-newly-requested.html

From XG you may validate via the below:

#openssl x509 -in /conf/certificate/cacerts/CANAME -text -noout | grep -i signature

A similar way confirms for the Cert file as well if the cert does not have an updated signature which is not getting matched with added one on XG.

#openssl x509 -in /conf/certificate/CERTNAME -text -noout | grep -i signature

If the above is the reason based on your validation then you may re-import the CA on XG with the latest signature algorithm and then you may confirm the status.

Regards,

Vishal Ranpariya
Technical Account Manager | Sophos Technical Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up +1 Vote Down

Cancel
0 TarekHalloun over 2 years ago in reply to Vishal_R

if i dont use sophos , i dont have this problem ... i cannot do this solution to 1000 users !

please guide me through this command .. how to run it
Cancel
Vote Up 0 Vote Down

Cancel
0 Vishal_R over 2 years ago in reply to TarekHalloun

Hi TarekHalloun Yes command has been shared in my previous comment which you may run from the XG shell. On the system side, you may compare it with any 1 or 2 machines to see if there are any differences in the signature algorithm on available cert/CA in the system and added on XG.

Regards,

Vishal Ranpariya
Technical Account Manager | Sophos Technical Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 TarekHalloun over 2 years ago in reply to Vishal_R

Vishal_R said:
you may compare it with any 1 or 2 machines to see if there are any differences in the signature algorithm on available cert/CA in the system and added on XG.

what do you mean?
Cancel
Vote Up 0 Vote Down

Cancel
0 TarekHalloun over 2 years ago in reply to Vishal_R

command didnt work
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 2 years ago in reply to TarekHalloun

Hi,

you are in the wrong screen, you should have used 5 - 3.

ian

XG115W - v19.5.1 mr-1 - Home

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 TarekHalloun over 2 years ago in reply to rfcat_vk

ok , both command typed but received nothing after enter ( i replaced the CANAME and CERTNAME with the actual names)
Cancel
Vote Up 0 Vote Down

Cancel
0 TarekHalloun over 2 years ago in reply to Vishal_R

if i import the certificate to my local pc certificate , i see that the certification is ok .. but the one coming from Sophos is always damaged ..

sophos is changing or corrupting the certificate somehow
Cancel
Vote Up 0 Vote Down

Cancel