Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • +5 person also asked this people also asked this
  • Locked Locked
  • Replies 24 replies
  • Answers 2 answers
  • Subscribers 36 subscribers
  • Views 109163 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG (SFOS 16.01.2) HTTPS scanning disabled but XG still uses Sophos CA for block pages on HTTPS Sites

RickDunsirn

This is very odd.  I have HTTPS scanning disabled and have even created an exception for my IP for all HTTPS scanning.  However, when going to an HTTPS site that is blocked (facebook.com for example), it is using the Sophos CA for the block page, which does not work on the endpoint, because it does not nor can have the Sophos CA installed as a trusted CA.  Why does XG use the Sophos CA as the root for blocked pages if I have HTTPS inspection turned off?  If I go to an HTTPS site that is NOT blocked, it works fine and it is NOT using the Sophos CA...just blocked pages are getting the "Certificate cannot be trusted" and show Sophos as the root CA in the certificate:

Here are some pictures:

Facebook is blocked, but we are getting this instead of a blocked page:

Here is the certificate...Sophos CA?!?!

Here are my settings for HTTPS inspection:

Here is an allowed HTTPS page (google) with the certificate...notice Sophos is NOT the CA:



This thread was automatically locked due to age.
  • 0

    Hi Rick,

    I think you have micro-app discovery defined in the Application Filter policy, which will decrypt the HTTPS-based Web Application and throw the certificate error. Uncheck the micro-app option in the Application-Policy and clear the browsers cache. 

    Any help with that?

  • 0 in reply to sachingurung

    Thanks for the response.  I've disabled application filtering altogether (so no micro-app scanning) and am still seeing the Sophos CA for blocked HTTPS sites:

    Still seeing the Sophos CA, so it is still trying to decrypt traffic for blocked HTTPS pages:

    It does not scan HTTPS for allowed pages, however.

  • 0 in reply to RickDunsirn

    HI RickDunsirn , 

    If you did not enable Malware scanning on HTTPS and also Application filter then you may go console and type the command 

    Console> system application_classification microapp-discovery off

    If you wish to use micro app discovery then you would need to install SSL CA certificate onto your systems and enable the option again instead of off. 

     

    Thanks and Regards

    Aditya Patel | Sophos Network and Security Engineer. 

  • 0 in reply to Aditya Patel

    Thanks again for the response.  It doesn't appear that disabling the Micro-app discovery has worked.

    I've disabled the Micro-app Discovery as shown here:

    Opened up an incognito browser in order to have a clean slate.  I opened up a blocked HTTPS site (Facebook).  I am still seeing the root CA as being Sophos:

    If I go to an allowed HTTPS site, the certificate chain properly has the root CA of the site:

  • 0 in reply to RickDunsirn

    Hi RickDunsirn, 

    Next  Step of Action . 

    1 . Run the website in In incognito mode or Private mode. 

    Clear the history and Cache Details.

    2. Create a Plain Firewall rule and Place on the Top position with no Scanning and no policies applied with no Match for Users applied. 

    Any results ?

  • 0 in reply to Aditya Patel

    I added the following rule to the firewall policy.  I can't have nothing in the policy for the web filtering because otherwise I won't get a blocked page, which is what this ticket is all about (HTTPS blocked sites present Sophos CA certificate even when SSL scanning is turned off):

    Like before, I open up an incognito browser window, which has no cache or history.  I open up a site that is blocked, in this example, Facebook.  The block page is unable to come up on the device because the CA certificate is still showing Sophos as the root CA:

    I am not sure why Sophos XG is presenting the block page with it's own Root CA.

  • 0 in reply to RickDunsirn

    Rick,

     

    By any chance, are you trying to connect through SSL VPN when seeing these Sophos certificates?

    What we noticed is similar behavior where we see Sophos Certificates where we are not seeing these when we connect to the specific server from any other source than SSL VPN.

     

    So far the 'magicians' think it is a routing issue (config issue) but this behavior started right after the upgrade from v15 to v16.

     

  • 0

    Rick,

    send me a PM and I will have a look at it.

    Thanks

  • 0 in reply to BasSanders

    For the SSL VPN question, the answer is "no".  I am just using this as a gateway with PC's behind it.

  • 0 in reply to lferrara

    I sent a private message to you.  Thanks!