Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Locked Locked
  • Replies 9 replies
  • Subscribers 31 subscribers
  • Views 13021 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

HTTPS-Scan | Signing-CA | Zertifikat läuft aus

TJ Hooker

Hallo Forengemeinde!

Ich lasse bei mir auch den HTTPS-Verkehr scannen. Dazu habe ich das Zertifikat der UTM (Web Protection | Filtering Options | HTTPS CAs) vor längerer Zeit heruntergeladen und via GPO als "Vertrauenswürdige Stammzertifizierungsstelle" an meine Clients verteilt. Das so verteilte Zertifikat läuft nun demnächst aus.

Was ist zu tun?

An o.g. Stelle (Web Protection | Filtering Options | HTTPS CAs) auf "Regenerate" klicken, das auf diese Weise neu erstellte Zertifikat herunterladen und eine neue GPO mit diesem Zertifikat erstellen, damit es an die Cients verteilt wird? Das war´s dann schon?

Durch das "Regenerate" wird das alte Zertifikat auf den Clients ungültig nehme ich an?
Meine User bekommen also ggf. so lange Zertifikats-Warnungen, bis das neue Zertifikat auf den Clients angekommen ist, korrekt?

Vielen Dank im Voraus!

TJ



This thread was automatically locked due to age.
Parents
  • 0

    Proposed sequence to prevent any user downtime:

    • Disable decrypt-and-scan on all Filter Profiles.
    • Generate  the new CA certificate
    • Update the GPO, adding the new CA certificate and removing the old one.
    • Wait at least two hours for the GPO to deploy
    • Enable decrypt-and-scan again

    However, the certificate is a machine-level GPO setting, so I am not sure if it will update every two hours or only on machine reboot.

  • 0 in reply to DouglasFoster

    Many thanks for explanation, this will help me.

    But the question was if it is possible too, to import the old certificate back into appliance after generate a new one. So we will have enough time to distribute the new certificate. The reason is that the certificate can´t distribute with GPO for Mozilla Firefox.

Reply
  • 0 in reply to DouglasFoster

    Many thanks for explanation, this will help me.

    But the question was if it is possible too, to import the old certificate back into appliance after generate a new one. So we will have enough time to distribute the new certificate. The reason is that the certificate can´t distribute with GPO for Mozilla Firefox.

Children
No Data