Safari can't establish a secure connection to XG Firewall - Chrome/FF OK

Maurice,

in addition: did you upgrade the XG from one version to another in the meanwhile? If yes, give us more details regarding from which version you came from. Thanks

Thanks for your suggestions. I have not upgraded the XG software version, I am still running 16.5. I just try to access the web interface of my firewall, no NAT or WAF at all.  Of course it might be a Safari issue, but I use Safari a lot and have never such a this problem before.

- Maurice

Thanks for the info.

Try to delete the Certificate Authority and then import it again into Safari. Safari uses CA saved on MAC.

Regards

Interesting, I had the exact opposite ff cracked even after importing the CA from the XG.

Eventually delete worked well.

Hi lferra

Your post together with this blog entry helped me solve the problem. I did not find any way to view in Safari what certificate was returned to the client. In Chrome I had to use Developer Tools, and this allowed me to solve the problem.

To recap: I have two valid certificates in the appliance, one self-signed (Self-Signed CA) and one from another CA where I had to upload the CA root cert to the appliance (ExtCA root). I was unable to connect from Safari with any of them, Chrome worked with the Self-Signed CA. Checking the System Keychain on my macOS system, the Self-Signed CA was not present, and the ExtCA root was not trusted. After importing the Self-Signed CA and setting both CAs to "Trust", I was again able to connect via Safari.

- Maurice

Hi lferra

Your post together with this blog entry helped me solve the problem. I did not find any way to view in Safari what certificate was returned to the client. In Chrome I had to use Developer Tools, and this allowed me to solve the problem.

To recap: I have two valid certificates in the appliance, one self-signed (Self-Signed CA) and one from another CA where I had to upload the CA root cert to the appliance (ExtCA root). I was unable to connect from Safari with any of them, Chrome worked with the Self-Signed CA. Checking the System Keychain on my macOS system, the Self-Signed CA was not present, and the ExtCA root was not trusted. After importing the Self-Signed CA and setting both CAs to "Trust", I was again able to connect via Safari.

- Maurice